EUVD-2026-60549
GHSA-f7jm-86g7-97p8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network and unauthenticated (AV:N/PR:N), but 'under certain circumstances' plus required LTI configuration and identity-mapping conditions justify AC:H; account takeover gives C:H/I:H while availability impact is not indicated (A:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Learning Tools Interoperability (LTI) under certain circumstances. This applies to LTI 1.1 and LTI 1.3 Advantage.
AnalysisAI
Unauthorized internal-account access in Mahara ePortfolio (all releases before 25.04.5 and 26.04.0) allows remote attackers to log into other users' accounts by abusing the Learning Tools Interoperability (LTI) integration, an authentication-bypass class flaw affecting both the LTI 1.1 and LTI 1.3 Advantage connectors. The issue occurs 'under certain circumstances,' implying LTI must be configured and reachable, and no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the target Mahara instance to have the LTI integration enabled and configured - specifically LTI 1.1 or LTI 1.3 Advantage - as the vulnerable code path is the LTI launch/identity-mapping flow; instances without LTI configured are not exploitable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) presents this as a trivially exploitable, network, unauthenticated account takeover, but the description's qualifier 'under certain circumstances' and the LTI-specific scope materially narrow real-world exposure: only Mahara instances with LTI 1.1 or LTI 1.3 Advantage configured are affected, which contradicts the AC:L rating and argues for higher attack complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Mahara 25.04.5 (for the 25.04 series) or 26.04.0, per the Mahara advisory at https://mahara.org/interaction/forum/topic.php?id=10077. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm whether LTI 1.1 or LTI 1.3 Advantage connectors are enabled in your Mahara deployment and audit access logs for anomalous cross-user authentication activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today