Description

Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Learning Tools Interoperability (LTI) under certain circumstances. This applies to LTI 1.1 and LTI 1.3 Advantage.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-17T22:17:05.687Z",
  "pubdate": "2026-08-17T22:17:05.687Z",
  "executiveSummary": "Mahara before versions 25.04.5 and 26.04.0 contains an unauthorized access vulnerability affecting internal user accounts via the Learning Tools Interoperability (LTI) subsystem. This security flaw impacts deployments utilizing LTI 1.1 and LTI 1.3 Advantage protocols. An external attacker or unauthorized entity meeting specific contextual circumstances can exploit this flaw to bypass authentication mechanisms and gain unauthorized access to sensitive internal user accounts within the application. The risk implications include potential data exposure, unauthorized modification of user portfolios, and compromise of user identity within the e-portfolio platform. Exploitation requires interaction with the LTI integration endpoints under conditions where access validation checks are insufficiently enforced, allowing unauthorized session establishment or account mapping. Remediation requires updating the affected software to the patched versions specified by the vendor.",
  "technicalDetails": "The vulnerability resides within the Learning Tools Interoperability (LTI) integration modules of Mahara, specifically impacting both LTI 1.1 and LTI 1.3 Advantage implementations. The root cause stems from improper validation and handling of incoming LTI launch requests or identity assertions, which under certain circumstances fails to correctly verify the authorization boundaries between the external tool provider/consumer and internal user accounts. When an LTI launch request is processed, the application is responsible for mapping incoming identity claims to local user profiles. Due to insufficient checks in this mapping or session creation logic, an interaction anomaly occurs where an untrusted or improperly validated LTI payload can result in the unauthorized binding to or direct access of existing internal accounts. The attack flow involves an adversary crafting or leveraging specific LTI protocol messages directed at the Mahara LTI endpoint. By exploiting the logic flaw in how these protocol messages are interpreted and mapped, the attacker bypasses standard credential-based authentication requirements. Network exposure is defined by the accessibility of the Mahara LTI integration endpoints, which must be reachable by external LTI consumers or the attacker. No prior valid internal authentication or elevated privileges are required to initiate the attack vector, provided the exploitation conditions are met. The post-exploitation impact includes full session hijacking or unauthorized account takeover of internal accounts, leading to potential confidentiality and integrity breaches of user data stored within the Mahara platform."
}