{"id":"CVE-2026-112868","kind":"vulnerability","aliases":["CVE-2026-112868"],"related":[],"title":"H5P: authorization bypass through a user-controlled key, versions through 1.17.9","description":"Authorization Bypass Through User-Controlled Key vulnerability in H5P H5P h5p allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects H5P: from n/a through 1.17.9.","summary":"H5P, a WordPress and Drupal plugin for interactive content, has an authorization bypass where a user-controlled key is used to reach access control checks incorrectly. An attacker may be able to access content or actions they should not reach, according to the advisory's description of incorrectly configured access control levels.","severity":"medium","cvss":4.3,"epss":0.00216,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","h5p","package","wordpress"],"not_affected_if":["h5p-not-installed"],"how_to_check":"- Look for the H5P plugin in the WordPress or Drupal plugin list and read its version; the affected range is up to and including `1.17.9`.\n- unknown for other checks, the sources do not say which endpoint or setting is involved.","fix":"- Update the H5P plugin to a version later than `1.17.9`; the sources do not name the exact fixed version.","status":"open","published_at":"2026-10-21T18:17:24+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T04:37:41+00:00","updated_at":"2026-10-25T04:37:41+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-25T04:37:41Z","model":"claude-haiku-5-5","output":{"fix":"- Update the H5P plugin to a version later than `1.17.9`; the sources do not name the exact fixed version.","reach":"internet","title":"H5P: authorization bypass through a user-controlled key, versions through 1.17.9","impact":"medium","summary":"H5P, a WordPress and Drupal plugin for interactive content, has an authorization bypass where a user-controlled key is used to reach access control checks incorrectly. An attacker may be able to access content or actions they should not reach, according to the advisory's description of incorrectly configured access control levels.","category":"package","nicknames":[],"who_cares":["wordpress","drupal","h5p"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Unauthorized users may reach protected H5P content or actions.","analyst_note":"Find the H5P advisory and the fixed version, and confirm which access control setting or endpoint is involved (NVD entry CVE-2026-112868 at nvd.nist.gov).","how_to_check":"- Look for the H5P plugin in the WordPress or Drupal plugin list and read its version; the affected range is up to and including `1.17.9`.\n- unknown for other checks, the sources do not say which endpoint or setting is involved.","needs_analyst":true,"not_affected_if":["h5p-not-installed"],"who_is_affected":"Sites running the H5P plugin at version `1.17.9` or earlier are in the stated range. The sources do not say which access control settings make a site exposed, so unknown whether a default install is affected. Teams not running H5P can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000623,"input_tokens":3347,"output_tokens":576,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112868':15A,18A '-2026':14A,17A '1.17.9':12A,102C 'abl':54B 'access':46B,56B,73B,92C 'accord':64B 'action':59B 'advisori':67B 'affect':97C 'allow':88C 'attack':51B 'author':2A,34B,76C 'bypass':3A,35B,77C 'check':48B 'configur':72B,91C 'content':31B,57B 'control':8A,40B,47B,74B,81C,93C 'cve':13A,16A 'descript':69B 'drupal':19B,27B 'exploit':89C 'h5p':1A,20B,23B,85C,86C,87C,98C 'incorrect':49B,71B,90C 'interact':30B 'issu':96C 'key':9A,41B,82C 'level':75B 'levels.this':95C 'may':52B 'n/a':100C 'packag':21B 'plugin':28B 'reach':45B,63B 'secur':94C 'use':43B 'user':7A,39B,80C 'user-control':6A,38B,79C 'version':10A 'vulner':83C 'wordpress':22B,25B","nicknames":[],"mitigations":[],"who_affected":"Sites running the H5P plugin at version `1.17.9` or earlier are in the stated range. The sources do not say which access control settings make a site exposed, so unknown whether a default install is affected. Teams not running H5P can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T18:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112868","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112868","severity":null,"published_at":"2026-10-21T18:17:24+00:00","modified_at":"2026-10-22T11:17:36+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-112868","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112868","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}