CVE-2026-123655: Moodle: missing access checks on h5p content files
Published Nov 6, 2026
·Updated
A flaw was found in Moodle. Insufficient access control checks on H5P content files allow unauthenticated remote attackers to view restricted materials, including content stored in the system context and files belonging to hidden or unavailable course modules. This issue results in unauthorized information disclosure of protected content.
Other sources
A flaw was found in Moodle's H5P content handling. Insufficient access checks on H5P content files, including extracted and repackaged content stored in the system context and files belonging to hidden or unavailable course modules, could allow users, including those who were not logged in, to view H5P content they did not have permission to access.
— Red Hat
Affected Software
0 affected components
Event History
Nov 6, 2026
Data Sourced
via Red Hat·08:58 AM
DescriptionSeverityAffected Software
CVE Published
via MITRE·11:45 AM
Data Sourced
via MITRE·11:45 AM
DescriptionSeverityWeakness