CVE-2026-113702: iomad PDF Certificate lib.php local_iomad_pluginfile authorization

Q: Which Iomad releases are affected?

The issue affects Iomad releases up to 4.5.15, 5.0.11, 5.1.8, and 5.2.4.

Q: What access does an attacker need?

The vulnerability can be exploited remotely and requires low-level privileges. No user interaction is required.

Q: What is the impact of successful exploitation?

Successful exploitation results in an authorization bypass in the PDF Certificate Handler's local_iomad_pluginfile function. The stated impact is limited confidentiality exposure; integrity and availability impacts are not indicated.

Q: What should be done to remediate the issue?

Apply the vendor patch. The listed patch identifiers are ac7427130865ce0ed80870813317c87ae3060fa4, 7bf0b10199782e04aa579e9d516e473b164afd1c, db903abdcb3aba124cce670608ae6d7ba5f51a84, and 66f7417c5357b7575e39e8be390602156c1a1225.

Published Nov 9, 2026

Updated

A security flaw has been discovered in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this vulnerability is the function localiomadpluginfile in the library public/local/iomad/lib.php of the component PDF Certificate Handler. The manipulation results in authorization bypass. The attack can be launched remotely. The patch is identified as ac7427130865ce0ed80870813317c87ae3060fa4/7bf0b10199782e04aa579e9d516e473b164afd1c/db903abdcb3aba124cce670608ae6d7ba5f51a84/66f7417c5357b7575e39e8be390602156c1a1225. It is advisable to implement a patch to correct this issue. This CVE was requested by the vendor.

Affected Software

1 affected component

Iomad Iomad<=4.5.15, <=5.0.11, <=5.1.8, <=5.2.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade iomad PDF Certificate Handler to a version that resolves this vulnerability.
Patch ac7427130865ce0ed80870813317c87ae3060fa4/7bf0b10199782e04aa579e9d516e473b164afd1c/db903abdcb3aba124cce670608ae6d7ba5f51a84/66f7417c5357b7575e39e8be390602156c1a1225

Event History

Nov 9, 2026

CVE Published

via MITRE·10:45 AM

Data Sourced

via MITRE·10:45 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which Iomad releases are affected?

The issue affects Iomad releases up to 4.5.15, 5.0.11, 5.1.8, and 5.2.4.

What access does an attacker need?

The vulnerability can be exploited remotely and requires low-level privileges. No user interaction is required.

What is the impact of successful exploitation?

Successful exploitation results in an authorization bypass in the PDF Certificate Handler's local_iomad_pluginfile function. The stated impact is limited confidentiality exposure; integrity and availability impacts are not indicated.

What should be done to remediate the issue?

Apply the vendor patch. The listed patch identifiers are ac7427130865ce0ed80870813317c87ae3060fa4, 7bf0b10199782e04aa579e9d516e473b164afd1c, db903abdcb3aba124cce670608ae6d7ba5f51a84, and 66f7417c5357b7575e39e8be390602156c1a1225.

CVE-2026-113702: iomad PDF Certificate lib.php local_iomad_pluginfile authorization

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Iomad releases are affected?

What access does an attacker need?

What is the impact of successful exploitation?

What should be done to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which Iomad releases are affected?

What access does an attacker need?

What is the impact of successful exploitation?

What should be done to remediate the issue?