{"id":"CVE-2026-123655","kind":"vulnerability","aliases":["CVE-2026-123655"],"related":[],"title":"Moodle: H5P content files readable without login, including hidden course materials","description":"A flaw was found in Moodle. Insufficient access control checks on H5P content files allow unauthenticated remote attackers to view restricted materials, including content stored in the system context and files belonging to hidden or unavailable course modules. This issue results in unauthorized information disclosure of protected content.","summary":"Moodle's H5P content file handling skips access checks, so an unauthenticated remote attacker can view restricted materials. This includes content in the system context and files from hidden or unavailable course modules.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"moodle","fixed":["5.2.4","5.1.8","5.0.11","4.5.15"],"affected":"5.2 to 5.2.3, 5.1 to 5.1.7, 5.0 to 5.0.10, 4.5 to 4.5.14 and earlier unsupported versions","ecosystem":"vendor"}],"ecosystems":[],"tags":["h5p","lms","moodle","runtime","self-hosted"],"not_affected_if":["no-h5p-content"],"how_to_check":"Check your Moodle version (Site administration > Notifications, or version.php). Vulnerable: 5.2 to 5.2.3, 5.1 to 5.1.7, 5.0 to 5.0.10, 4.5 to 4.5.14, and earlier unsupported versions. Also check whether the site has any H5P content.","fix":"Upgrade Moodle to 5.2.4, 5.1.8, 5.0.11 or 4.5.15 (or later in your branch).","status":"open","published_at":"2026-11-06T12:17:20+00:00","first_seen_at":"2026-11-06T12:41:48+00:00","triaged_at":"2026-11-06T12:42:43+00:00","updated_at":"2026-11-06T12:43:35+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-11-06T12:42:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Moodle: H5P content files readable without login, including hidden course materials","impact":"medium","summary":"Moodle's H5P content file handling skips access checks, so an unauthenticated remote attacker can view restricted materials. This includes content in the system context and files from hidden or unavailable course modules.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["moodle","self-hosted","lms","h5p"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated users read protected course files and restricted materials","analyst_note":"Find the affected Moodle version ranges and the fixed releases; the linked Patch page on github.com should be checked for the versions tied to this CVE.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-h5p-content"],"who_is_affected":"Sites running Moodle with H5P content in courses are the ones exposed; the issue is reachable from the internet without an account. Sites without H5P content or with the affected Moodle versions patched can skip it. The sources do not list affected version ranges.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000642,"input_tokens":4202,"output_tokens":443,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected Moodle version ranges and the fixed releases; the linked Patch page on github.com should be checked for the versions tied to this CVE.","search":"'-123655':14A,17A '-2026':13A,16A 'access':33B,66C 'allow':73C 'attack':39B,76C 'belong':90C 'check':34B,68C 'content':3A,29B,46B,71C,82C,106C 'context':50B,87C 'control':67C 'cours':10A,57B,95C 'cve':12A,15A 'disclosur':103C 'file':4A,30B,52B,72C,89C 'flaw':60C 'found':62C 'h5p':2A,19B,28B,70C 'handl':31B 'hidden':9A,54B,92C 'host':25B 'includ':8A,45B,81C 'inform':102C 'insuffici':65C 'issu':98C 'lms':20B 'login':7A 'materi':11A,43B,80C 'modul':58B,96C 'moodl':1A,21B,26B,64C 'moodle':18A 'protect':105C 'readabl':5A 'remot':38B,75C 'restrict':42B,79C 'result':99C 'runtim':22B 'self':24B 'self-host':23B 'skip':32B 'store':83C 'system':49B,86C 'unauthent':37B,74C 'unauthor':101C 'unavail':56B,94C 'view':41B,78C 'without':6A","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Moodle sites on 5.2 to 5.2.3, 5.1 to 5.1.7, 5.0 to 5.0.10, 4.5 to 4.5.14 or any older unsupported version. Per the Moodle advisory, insufficient access checks on H5P content files let users, including people not logged in, view H5P content they have no permission to see. Sites with no H5P content, or already on a fixed release, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-06T12:43:35Z","by":"analyst","doc":"https://github.com/moodle/moodle/commit/4b42ce4ed1d132214fd4b7d4b5f4f0387ec28a49","run_id":1889},"how_to_check":{"at":"2026-11-06T12:43:35Z","by":"analyst","doc":"https://github.com/moodle/moodle/commit/4b42ce4ed1d132214fd4b7d4b5f4f0387ec28a49","run_id":1889},"who_affected":{"at":"2026-11-06T12:43:35Z","by":"analyst","doc":"https://github.com/moodle/moodle/commit/4b42ce4ed1d132214fd4b7d4b5f4f0387ec28a49","run_id":1889}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["moodle"],"ptokens":["moodle"],"labels":["h5p","high","lms","moodle","runtime","selfhosted"],"campaign_type":null,"search_a":"'-123655':14A,17A '-2026':13A,16A 'content':3A 'cours':10A 'cve':12A,15A 'file':4A 'h5p':2A 'hidden':9A 'includ':8A 'login':7A 'materi':11A 'moodl':1A 'moodle':18A 'readabl':5A 'without':6A","search_b":"'access':33B 'attack':39B 'check':34B 'content':29B,46B 'context':50B 'cours':57B 'file':30B,52B 'h5p':19B,28B 'handl':31B 'hidden':54B 'host':25B 'includ':45B 'lms':20B 'materi':43B 'modul':58B 'moodl':21B,26B 'remot':38B 'restrict':42B 'runtim':22B 'self':24B 'self-host':23B 'skip':32B 'system':49B 'unauthent':37B 'unavail':56B 'view':41B","search_c":"'access':66C 'allow':73C 'attack':76C 'belong':90C 'check':68C 'content':71C,82C,106C 'context':87C 'control':67C 'cours':95C 'disclosur':103C 'file':72C,89C 'flaw':60C 'found':62C 'h5p':70C 'hidden':92C 'includ':81C 'inform':102C 'insuffici':65C 'issu':98C 'materi':80C 'modul':96C 'moodl':64C 'protect':105C 'remot':75C 'restrict':79C 'result':99C 'store':83C 'system':86C 'unauthent':74C 'unauthor':101C 'unavail':94C 'view':78C","first_public_at":"2026-11-06T12:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"patrick@puiterwijk.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123655","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123655","severity":null,"published_at":"2026-11-06T12:17:20+00:00","modified_at":"2026-11-06T12:17:20+00:00","first_seen_at":"2026-11-06T12:41:48+00:00","fetched_at":"2026-11-06T12:41:48+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123655:1889","url":"https://moodle.org/mod/forum/discuss.php?d=482830","severity":null,"published_at":"2026-11-06T12:43:35+00:00","modified_at":"2026-11-06T12:43:35+00:00","first_seen_at":"2026-11-06T12:43:35+00:00","fetched_at":"2026-11-06T12:43:35+00:00","note":"Moodle MSA-26-0044 (MDL-89547) read on moodle.org; advisory lists CVE as pending, matched to this CVE by the same commit 4b42ce4 and description. No exploitation or PoC found.","cites":["https://moodle.org/mod/forum/discuss.php?d=482830"]}],"documents":[{"id":86328,"url":"https://github.com/moodle/moodle/commit/4b42ce4ed1d132214fd4b7d4b5f4f0387ec28a49","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":86427,"url":"https://moodle.org/mod/forum/discuss.php?d=482830","title":"MSA-26-0044: Missing access checks on H5P content files","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}