Mahara EUVD-2025-209574

| CVE-2025-59308 MEDIUM

Improper Access Control (CWE-284)

2026-04-24 mitre

Authentication Bypass N A

4.7

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Apr 24, 2026 - 18:15 vuln.today

CVSS changed

Apr 24, 2026 - 17:22 NVD

4.7 (MEDIUM)

DescriptionNVD

In Mahara before 24.04.10 and 25 before 25.04.1, an institution administrator or institution support administrator on a multi-tenanted site can masquerade as an institution member in an institution for which they are not an administrator, if they also have the 'Site staff' role.

AnalysisAI

Institution administrators with Site staff role in Mahara can impersonate institution members in other institutions where they lack administrative privileges, bypassing intended access controls on multi-tenanted deployments. Affects Mahara versions before 24.04.10 and 25.x before 25.04.1. This requires high-privilege authentication (Site staff role) and does not involve network exploitation of unauthenticated services, limiting real-world attack surface to insider threats within organizations running affected versions.

Technical ContextAI

Mahara is a multi-tenanted portfolio and learning platform. The vulnerability stems from insufficient privilege validation in the role hierarchy, specifically in how institution administrator and Site staff roles interact across institutional boundaries (CWE-284: Improper Access Control). Multi-tenanted deployments segregate data and users by institution; the flaw allows a Site staff member who also holds an institution administrator role to assume identities of members in sibling institutions without proper authorization checks. This is a privilege escalation issue rooted in inadequate scope enforcement between administrative role checks and user impersonation mechanisms.

RemediationAI

Upgrade to Mahara 24.04.10 or later for the 24.04 branch, or upgrade to Mahara 25.04.1 or later for the 25.x branch. The vendor advisory at https://mahara.org/interaction/forum/topic.php?id=9851 contains detailed patch information and deployment guidance. As a temporary workaround for organizations unable to patch immediately, restrict Site staff role assignment to only those users who also legitimately require institution administrator privileges across all institutions, and implement role audit logging to detect suspicious impersonation attempts. Note that this workaround weakens intended multi-tenancy segregation and is not a long-term substitute for patching.

EUVD-2025-209574 vulnerability details – vuln.today

Back