CVE-2026-112868

Deferred Deferred - Pending Action

Authorization Bypass in H5P Due to Misconfigured Access Control

Publication date: 2026-10-21

Last updated on: 2026-10-22

Assigner: Patchstack

Description

Authorization Bypass Through User-Controlled Key vulnerability in H5P H5P h5p allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects H5P: from n/a through 1.17.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-22

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-112868

EUVD

EUVD-2026-107427

Affected Vendors & Products

Vendor	Product	Version / Range
H5P	H5P	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an Authorization Bypass Through User-Controlled Key issue in the H5P plugin for WordPress. It allows attackers to exploit incorrectly configured access control security levels to access unauthorized data by manipulating user-controlled keys or IDs in URLs.

Detection Guidance

Check if your H5P plugin version is 1.17.9 or below. Look for unusual access patterns or unauthorized data exposure in logs. Monitor for ID manipulation attempts in URLs or API requests.

Impact Analysis

Attackers could access other users' data by changing IDs in URLs, potentially exposing sensitive information. This could lead to data leaks or unauthorized actions depending on the plugin's usage.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating compliance requirements for data protection standards like GDPR or HIPAA, which mandate strict access controls and data confidentiality.

Mitigation Strategies

Update the H5P plugin to version 1.17.10 or later immediately. Enable auto-updates if available. Review access controls and user permissions to ensure proper restrictions.

Hi! I’m here to help you understand CVE-2026-112868. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...