Moodle security policy bypass flaw CVE-2026-123655 fixed in 4.5.15, 5.0.11, 5.1.8 and 5.2.4
Moodle tracks CVE-2026-123655 in its security bulletin 482830, dated 15 October 2026, and CERT-FR relayed that bulletin in advisory CERTFR-2026-AVI-1481 (cert.cyber.gouv.fr). The flaw lets an attacker get around the platform's security policy, and the affected range covers every release before 4.5.15 plus the 5.0.x, 5.1.x and 5.2.x branches before 5.0.11, 5.1.8 and 5.2.4. The OpenCVE record for the same identifier (app.opencve.io) describes it as missing access checks on H5P content files, which let an unauthenticated remote user request restricted files, including content in the system context and files of hidden or unavailable course modules, and it lists a CVSS 3.1 score of 7.5 with an EPSS below 1% and no KEV entry. The Moodle bulletin itself could not be opened during this research, so the vendor's own severity and wording remain unconfirmed. Urgency is rated high because an unauthenticated information disclosure on a widely exposed learning platform is serious, while the absence of any reported exploitation keeps it below critical.
Entenda a falha
A vulnerabilidade
CVE-2026-123655 is a security policy bypass in Moodle, tracked in Moodle bulletin 482830 of 15 October 2026 and relayed by CERT-FR as CERTFR-2026-AVI-1481. According to OpenCVE (not the vendor, whose bulletin could not be opened), it is missing access checks on H5P content files (CWE-862), with CVSS 3.1 of 7.5. An unauthenticated remote user with network access to the instance can request restricted files, including system-context content and files of hidden or unavailable course modules. Affected: every release before 4.5.15, 5.0.x before 5.0.11, 5.1.x before 5.1.8 and 5.2.x before 5.2.4, which are the fixed versions. EPSS is below 1% and there is no KEV entry.
Como funciona
Moodle serves H5P content files to users through its pluginfile handling in the core H5P component. A request for such a file reaches that handler, which should confirm that the requester may see the file given its context, for example the system context or a course module that is hidden or unavailable. According to OpenCVE, those checks are insufficient, so the file is returned even when the requester has no session and should not have access.
Por que é vulnerável
The root cause is a missing authorization check (CWE-862) in the H5P file handling, which does not properly verify access to files in the system context or in hidden course modules. The fix is titled 'core_h5p: Improve pluginfile handling', which suggests it tightens that handling. The articles do not explain why it went unnoticed.
Onde está
The fix is commit 4b42ce4ed1d132214fd4b7d4b5f4f0387ec28a49 in github.com/moodle/moodle, MDL-89547 'core_h5p: Improve pluginfile handling', in the core H5P component.
Como foi descoberta
The articles do not say who found the flaw or how. They only say it was published in Moodle security bulletin 482830 on 15 October 2026, and CERT-FR relayed it in advisory CERTFR-2026-AVI-1481 (published 9 November 2026). No exploitation in the wild is reported.
Explicação gerada por IA a partir da matéria e dos artigos, em 09/11/2026 14:27.
Detalhes técnicos
The OpenCVE entry (app.opencve.io) attributes the weakness to CWE-862 and states that the H5P file handling checks are insufficient, so files stored in the system context or behind hidden course modules can be fetched without a session. The commit it references (github.com/moodle/moodle) carries the title MDL-89547 and concerns the pluginfile handling of the core H5P component. The prerequisite on the vendor side is not stated by the article, and the attack requires only a network path to the Moodle instance according to the OpenCVE description.
Detalhes da correção
The fix is commit 4b42ce4ed1d132214fd4b7d4b5f4f0387ec28a49 in github.com/moodle/moodle, titled MDL-89547 'core_h5p: Improve pluginfile handling'. The author, the pull request number and the merge date were not extracted from the cached commit page during this research. The article lists 4.5.15, 5.0.11, 5.1.8 and 5.2.4 as the fixed versions per branch, but this research did not confirm which of those releases contain this specific commit.
Remediação
Upgrade each Moodle installation to the fixed release of its branch: 4.5.15 for the 4.5 line, 5.0.11 for 5.0.x, 5.1.8 for 5.1.x and 5.2.4 for 5.2.x. The article points to the Moodle bulletin 482830 for the patches, and that bulletin was not reachable during this research, so the administrator should confirm the release notes there before deploying.
Relatos divergentes
The article classifies the issue only as a security policy bypass (cert.cyber.gouv.fr). The OpenCVE record (app.opencve.io) describes it as unauthorized disclosure of protected H5P content under CWE-862. The vendor bulletin could not be opened to decide which wording Moodle uses, so the disclosure description is attributed to OpenCVE and not to the vendor.
Linha do tempo
-
Moodle security policy bypass flaw CVE-2026-123655 fixed in 4.5.15, 5.0.11, 5.1.8 and 5.2.4
ler a análise desta fonte ocultar
Moodle tracks CVE-2026-123655 in its security bulletin 482830, dated 15 October 2026, and CERT-FR relayed that bulletin in advisory CERTFR-2026-AVI-1481 (cert.cyber.gouv.fr). The flaw lets an attacker get around the platform's security policy, and the affected range covers every release before 4.5.15 plus the 5.0.x, 5.1.x and 5.2.x branches before 5.0.11, 5.1.8 and 5.2.4. The OpenCVE record for the same identifier (app.opencve.io) describes it as missing access checks on H5P content files, which let an unauthenticated remote user request restricted files, including content in the system context and files of hidden or unavailable course modules, and it lists a CVSS 3.1 score of 7.5 with an EPSS below 1% and no KEV entry. The Moodle bulletin itself could not be opened during this research, so the vendor's own severity and wording remain unconfirmed. Urgency is rated high because an unauthenticated information disclosure on a widely exposed learning platform is serious, while the absence of any reported exploitation keeps it below critical.
Technical Details
The OpenCVE entry (app.opencve.io) attributes the weakness to CWE-862 and states that the H5P file handling checks are insufficient, so files stored in the system context or behind hidden course modules can be fetched without a session. The commit it references (github.com/moodle/moodle) carries the title MDL-89547 and concerns the pluginfile handling of the core H5P component. The prerequisite on the vendor side is not stated by the article, and the attack requires only a network path to the Moodle instance according to the OpenCVE description.
Fix Details
The fix is commit 4b42ce4ed1d132214fd4b7d4b5f4f0387ec28a49 in github.com/moodle/moodle, titled MDL-89547 'core_h5p: Improve pluginfile handling'. The author, the pull request number and the merge date were not extracted from the cached commit page during this research. The article lists 4.5.15, 5.0.11, 5.1.8 and 5.2.4 as the fixed versions per branch, but this research did not confirm which of those releases contain this specific commit.
Remediation
Upgrade each Moodle installation to the fixed release of its branch: 4.5.15 for the 4.5 line, 5.0.11 for 5.0.x, 5.1.8 for 5.1.x and 5.2.4 for 5.2.x. The article points to the Moodle bulletin 482830 for the patches, and that bulletin was not reachable during this research, so the administrator should confirm the release notes there before deploying.
Conflicting Reports
The article classifies the issue only as a security policy bypass (cert.cyber.gouv.fr). The OpenCVE record (app.opencve.io) describes it as unauthorized disclosure of protected H5P content under CWE-862. The vendor bulletin could not be opened to decide which wording Moodle uses, so the disclosure description is attributed to OpenCVE and not to the vendor.