Description

A flaw was found in Moodle. Insufficient access control checks on H5P content files allow unauthenticated remote attackers to view restricted materials, including content stored in the system context and files belonging to hidden or unavailable course modules. This issue results in unauthorized information disclosure of protected content.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-11-06T12:17:20.657Z",
  "pubdate": "2026-11-06T12:17:20.657Z",
  "executiveSummary": "A critical access control vulnerability exists within the Moodle H5P integration, categorized as an Improper Authorization flaw. This vulnerability enables unauthenticated remote attackers to bypass security constraints and retrieve restricted H5P content files. The exposure encompasses sensitive data stored within the system context, as well as files associated with course modules that are designated as hidden or unavailable to the general user base. The risk implication is significant, as it facilitates unauthorized information disclosure of proprietary or protected instructional materials without requiring valid credentials or high-level administrative privileges. Because the flaw resides in the file handling mechanisms of the H5P subsystem, it exposes system-wide content, undermining the integrity of access control policies governing Moodle course environments. Successful exploitation allows an external threat actor to perform unauthorized reconnaissance and data exfiltration of internal assets, posing a substantial risk to institutional intellectual property and sensitive course configurations.",
  "technicalDetails": "The root cause of this vulnerability lies in insufficient server-side access control validation within the Moodle H5P file delivery subsystem. The application fails to adequately verify the authentication status and authorization context of requests directed toward H5P content files. Specifically, the mechanisms responsible for gating access to H5P assets rely on flawed permission checks that do not properly enforce module-level visibility or system-context restrictions.\nThe exploitation flow begins when an unauthenticated remote attacker identifies the direct URL structure utilized by Moodle to serve H5P content. By crafting specific HTTP requests to these endpoints, an attacker can bypass the intended authorization layer. Because the application logic fails to perform a comprehensive access control check before processing the file read operation, the server retrieves and streams the requested resource to the unauthenticated requester regardless of whether the content is intended for private, hidden, or system-level access.\nThe vulnerable component is the H5P file delivery interface, which processes requests for assets associated with H5P packages. During the lifecycle of a request, the server fails to validate the requester's identity or membership status within the course context hosting the H5P content. Consequently, the lack of a mandatory 'check_access' or 'is_enrolled' validation logic permits the retrieval of objects stored in protected system paths. This bypass is effective even if the content belongs to a course module that has been explicitly hidden by an instructor or administrator.\nExploitation does not require valid user credentials, making the attack vector accessible to any remote actor with network connectivity to the Moodle instance. The payload behavior is strictly read-only, focusing on the unauthorized exfiltration of sensitive course materials. Post-exploitation impact involves the total compromise of confidentiality for affected H5P assets. Once the attacker successfully requests a target file path, the application transmits the data directly to the client, allowing for the systematic harvesting of protected intellectual property, student materials, or system-level configuration files embedded within H5P packages."
}