CVE-2026-42163

Received Received - Intake

Unauthorized LTI Access in Mahara

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: MITRE

Description

Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Learning Tools Interoperability (LTI) under certain circumstances. This applies to LTI 1.1 and LTI 1.3 Advantage.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-17

Last Modified

2026-08-17

Generated

2026-08-18

AI Q&A

2026-08-18

EPSS Evaluated

N/A

NVD

CVE-2026-42163

EUVD

EUVD-2026-60549

Affected Vendors & Products

Vendor	Product	Version / Range
mahara	mahara	to 25.04.5\|end_excluding=26.04.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

Mahara versions before 25.04.5 and 26.04.0 have a flaw where internal accounts can be accessed without authorization through Learning Tools Interoperability (LTI) features. This issue affects both LTI 1.1 and LTI 1.3 Advantage protocols.

Impact Analysis

An attacker could exploit this to gain unauthorized access to internal user accounts in Mahara, potentially leading to data breaches, unauthorized modifications, or misuse of sensitive information stored in the system.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other regulations by enabling unauthorized access to personal or sensitive data, resulting in potential legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade Mahara to version 25.04.5 or later if using 25.x, or to 26.04.0 or later if using 26.x to address the LTI-related access issue.

Hi! I’m here to help you understand CVE-2026-42163. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70