Description

Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an artefact in a page is manipulated.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-17T23:16:52.023Z",
  "pubdate": "2026-08-17T23:16:52.023Z",
  "executiveSummary": "An access control vulnerability has been identified in Mahara before 25.04.5 and 26.04.0, specifically involving the handling of artefact file paths within pages. This flaw allows unauthorized users to bypass intended permission boundaries and gain access to sensitive artefacts that should otherwise remain restricted.\nThe vulnerability represents an authorization bypass and improper access control issue. By successfully manipulating the file path pointing to an artefact embedded within a page, an attacker can induce the application to serve resources improperly. The primary impact is the unauthorized disclosure of confidential data and user-generated artefacts stored within the Mahara platform.\nThe affected systems include instances of Mahara running versions prior to 25.04.5 and 26.04.0. The risk implications are moderate to high depending on the sensitivity of the exposed artefacts. Attack capabilities are limited to unauthorized read access of resources, requiring the ability to interact with page components and manipulate resource locators or file paths directly.\nExploitation requirements include network access to the target Mahara instance and the ability to identify or modify the specific file paths associated with artefacts inside a page. Remediation requires updating the affected software to the patched versions provided by the vendor.",
  "technicalDetails": "The root cause of this vulnerability lies in insufficient input validation and broken object-level authorization within Mahara's artefact and file serving subsystems. When users access pages containing artefacts, the application processes internal references to retrieve the associated files.\nSpecifically, when the file path to an artefact in a page is manipulated, the underlying routing and access control logic fail to properly validate whether the requesting user possesses the necessary viewing privileges for the targeted resource. This allows unauthorized actors to traverse or substitute path parameters, tricking the application into returning objects that fall outside the user's security context.\nThe attack flow proceeds as follows: First, an attacker identifies a page containing one or more valid artefacts. Second, the attacker intercepts or crafts a request referencing the file path of an artefact. Third, by systematically modifying the file path parameters—such as altering identifiers or path structures—the attacker submits the manipulated request to the server. Fourth, due to inadequate validation of the requested object against the active user session's permissions, the application retrieves and delivers the requested artefact, bypassing the authorization checks that typically govern direct access to the resource.\nThe vulnerable components are the routing, file retrieval, and permission-checking functions responsible for resolving artefact file paths embedded in Mahara pages. Affected versions encompass all Mahara deployments prior to 25.04.5 and 26.04.0.\nRegarding constraints, the vulnerability is exploitable over standard network protocols where the application is exposed. The attack relies on the manipulation of request parameters and does not inherently require administrative privileges or complex authentication states beyond what is necessary to interact with the target page or resource endpoints, depending on the exact exposure of the artefact references.\nThe post-exploitation impact is characterized by the unauthorized exposure of private documents, media, or other data objects stored as artefacts within the platform, potentially leading to a breach of user privacy and confidentiality."
}