Live › vulnerability › CVE-2026-112868
Go to dashboardH5P, a WordPress and Drupal plugin for interactive content, has an authorization bypass where a user-controlled key is used to reach access control checks incorrectly. An attacker may be able to access content or actions they should not reach, according to the advisory's description of incorrectly configured access control levels.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the H5P plugin at version 1.17.9 or earlier are in the stated range. The sources do not say which access control settings make a site exposed, so unknown whether a default install is affected. Teams not running H5P can skip it.
No product ranges from the sources yet.
1.17.9.1.17.9; the sources do not name the exact fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Authorization Bypass Through User-Controlled Key vulnerability in H5P H5P h5p allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects H5P: from n/a through 1.17.9.
This page as .md · .json · in your agent: get_signal("CVE-2026-112868")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.