---
id: "CVE-2026-112868"
kind: "vulnerability"
aliases: ["CVE-2026-112868"]
title: "H5P: authorization bypass through a user-controlled key, versions through 1.17.9"
severity: "medium"
cvss: 4.3
epss: 0.00216
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["drupal", "h5p", "package", "wordpress"]
not_affected_if: ["h5p-not-installed"]
published_at: "2026-10-21T18:17:24+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T04:37:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112868", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-112868", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# H5P: authorization bypass through a user-controlled key, versions through 1.17.9

H5P, a WordPress and Drupal plugin for interactive content, has an authorization bypass where a user-controlled key is used to reach access control checks incorrectly. An attacker may be able to access content or actions they should not reach, according to the advisory's description of incorrectly configured access control levels.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for the H5P plugin in the WordPress or Drupal plugin list and read its version; the affected range is up to and including `1.17.9`.
- unknown for other checks, the sources do not say which endpoint or setting is involved.

## Fix

- Update the H5P plugin to a version later than `1.17.9`; the sources do not name the exact fixed version.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112868
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-112868

## From the sources

Authorization Bypass Through User-Controlled Key vulnerability in H5P H5P h5p allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects H5P: from n/a through 1.17.9.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_