UBUNTU-CVE-2026-123655: High severity ubuntu/moodle vulnerability
A flaw was found in Moodle. Insufficient access control checks on H5P content files allow unauthenticated remote attackers to view restricted materials, including content stored in the system context and files belonging to hidden or unavailable course modules. This issue results in unauthorized information disclosure of protected content.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it. No privileges or user interaction are required.
What content may be exposed?
Restricted H5P content files may be disclosed, including files stored in the system context and files associated with hidden or unavailable course modules.
Does exploitation change or disrupt Moodle data?
The provided severity vector indicates high confidentiality impact with no integrity or availability impact. The described outcome is unauthorized viewing of protected content.