MOODLE · CVE-2026-123655 · Runtime
FIX → 5.2.4 · 4.5.15 +2 ✓ verified
Moodle's H5P content file handling skips access checks, so an unauthenticated remote attacker can view restricted materials. This includes content in the system context and files from hidden or unavailable course modules.
first public Nov 6, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted Moodle sites on 5.2 to 5.2.3, 5.1 to 5.1.7, 5.0 to 5.0.10, 4.5 to 4.5.14 or any older unsupported version. Per the Moodle advisory, insufficient access checks on H5P content files let users, including people not logged in, view H5P content they have no permission to see. Sites with no H5P content, or already on a fixed release, can skip it.
Not affected if no-h5p-content
Who cares h5p, lms, moodle, self-hosted
5.2.3, 5.1 to 5.1.7, 5.0 to 5.0.10, 4.5 to 4.5.14, and earlier unsupported versionsA flaw was found in Moodle. Insufficient access control checks on H5P content files allow unauthenticated remote attackers to view restricted materials, including content stored in the system context and files belonging to hidden or unavailable course modules. This issue results in unauthorized information disclosure of protected content.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 5.2.4 · 4.5.15 +2
Upgrade Moodle to 5.2.4, 5.1.8, 5.0.11 or 4.5.15 (or later in your branch).