---
id: "CVE-2026-123655"
page: "https://infrastack.ai/live/CVE-2026-123655"
kind: "vulnerability"
aliases: ["CVE-2026-123655"]
title: "Moodle: H5P content files readable without login, including hidden course materials"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "moodle", "fixed": ["5.2.4", "5.1.8", "5.0.11", "4.5.15"], "affected": "5.2 to 5.2.3, 5.1 to 5.1.7, 5.0 to 5.0.10, 4.5 to 4.5.14 and earlier unsupported versions", "ecosystem": "vendor"}]
ecosystems: []
tags: ["h5p", "lms", "moodle", "runtime", "self-hosted"]
not_affected_if: ["no-h5p-content"]
published_at: "2026-11-06T12:17:20+00:00"
first_seen_at: "2026-11-06T12:41:48+00:00"
updated_at: "2026-11-06T12:43:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123655", "first_seen_at": "2026-11-06T12:41:48+00:00"}, {"source": "analyst", "url": "https://moodle.org/mod/forum/discuss.php?d=482830", "first_seen_at": "2026-11-06T12:43:35+00:00", "cites": ["https://moodle.org/mod/forum/discuss.php?d=482830"]}]
exploit_sources: []
---

# Moodle: H5P content files readable without login, including hidden course materials

Link for people: https://infrastack.ai/live/CVE-2026-123655 (this .md is for agents)

Moodle's H5P content file handling skips access checks, so an unauthenticated remote attacker can view restricted materials. This includes content in the system context and files from hidden or unavailable course modules.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:moodle affected 5.2 to 5.2.3, 5.1 to 5.1.7, 5.0 to 5.0.10, 4.5 to 4.5.14 and earlier unsupported versions fixed 5.2.4, 5.1.8, 5.0.11, 4.5.15

## How to check

Check your Moodle version (Site administration > Notifications, or version.php). Vulnerable: 5.2 to 5.2.3, 5.1 to 5.1.7, 5.0 to 5.0.10, 4.5 to 4.5.14, and earlier unsupported versions. Also check whether the site has any H5P content.

## Fix

Upgrade Moodle to 5.2.4, 5.1.8, 5.0.11 or 4.5.15 (or later in your branch).

## Timeline

- 2026-11-06T12:41:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123655
- 2026-11-06T12:43:35+00:00 analyst https://moodle.org/mod/forum/discuss.php?d=482830 — Moodle MSA-26-0044 (MDL-89547) read on moodle.org; advisory lists CVE as pending, matched to this CVE by the same commit 4b42ce4 and description. No exploitation or PoC found.

## Documents

- [advisory] MSA-26-0044: Missing access checks on H5P content files https://moodle.org/mod/forum/discuss.php?d=482830
- [fix] Patch: github.com https://github.com/moodle/moodle/commit/4b42ce4ed1d132214fd4b7d4b5f4f0387ec28a49

## From the sources

A flaw was found in Moodle. Insufficient access control checks on H5P content files allow unauthenticated remote attackers to view restricted materials, including content stored in the system context and files belonging to hidden or unavailable course modules. This issue results in unauthorized information disclosure of protected content.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_