Access Control Vulnerability in Moodle Affects Unauthenticated Users
CVE-2026-123655

7.5HIGH

Key Information:

Status
Vendor
CVE Published:
6 November 2026

What is CVE-2026-123655?

A vulnerability has been identified in Moodle that allows unauthenticated remote attackers to bypass access controls on H5P content files. This weakness enables unauthorized users to gain visibility into restricted materials, including sensitive content stored in the system context and files associated with hidden or unavailable course modules. As a result, there is a risk of unauthorized information disclosure, compromising the confidentiality of protected content.

References

https://access.redhat.com/security/cve/CVE-2026-123655
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2568053
issue-trackingx_refsource_REDHAT
https://github.com/moodle/moodle/commit/4b42ce4ed1d132214...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Upstream acknowledges Jari Vilkman as the original reporter.
.