CVE-2026-42164

Received Received - Intake

Text Block Content Leak in Mahara

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: MITRE

Description

Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a certain way that allows it to recall the backed-up content from another Text section.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-17

Last Modified

2026-08-17

Generated

2026-08-18

AI Q&A

2026-08-18

EPSS Evaluated

N/A

NVD

CVE-2026-42164

EUVD

EUVD-2026-60548

Affected Vendors & Products

Vendor	Product	Version / Range
mahara	mahara	to 25.04.5\|end_excluding=26.04.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

Mahara before versions 25.04.5 and 26.04.0 has a vulnerability in the Text block or section functionality. An attacker can craft a specific call that allows them to retrieve backed-up content from another Text section, potentially exposing sensitive information.

Impact Analysis

This vulnerability could allow unauthorized access to private or sensitive content stored in Text sections. If exploited, it may lead to data leaks, privacy breaches, or unauthorized information disclosure depending on the content stored in those sections.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA if it results in unauthorized access to personal or health data. Organizations may face legal penalties, reputational damage, and loss of trust due to data breaches.

Mitigation Strategies

Update Mahara to version 25.04.5 or later if using 25.x, or to 26.04.0 or later if using 26.x. Review Text block/section content for unauthorized access or modifications.

Hi! I’m here to help you understand CVE-2026-42164. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70