CVE Catalog
CVE-2026-42163
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk0.15%
5th percentile - higher than 5% of all known CVEs
Summary
Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Learning Tools Interoperability (LTI) under certain circumstances. This applies to LTI 1.1 and LTI 1.3 Advantage.
Risk Assessment
Unauthorized access to internal accounts can lead to data confidentiality breaches and system integrity issues.
Recommendation
Update Mahara to version 25.04.5 or 26.04.0 or later.
Original NVD description (English source)
Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Learning Tools Interoperability (LTI) under certain circumstances. This applies to LTI 1.1 and LTI 1.3 Advantage.