EUVD-2025-209574Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
5DescriptionCVE.org
In Mahara before 24.04.10 and 25 before 25.04.1, an institution administrator or institution support administrator on a multi-tenanted site can masquerade as an institution member in an institution for which they are not an administrator, if they also have the 'Site staff' role.
AnalysisAI
Institution administrators with Site staff role in Mahara can impersonate institution members in other institutions where they lack administrative privileges, bypassing intended access controls on multi-tenanted deployments. Affects Mahara versions before 24.04.10 and 25.x before 25.04.1. This requires high-privilege authentication (Site staff role) and does not involve network exploitation of unauthenticated services, limiting real-world attack surface to insider threats within organizations running affected versions.
Technical ContextAI
Mahara is a multi-tenanted portfolio and learning platform. The vulnerability stems from insufficient privilege validation in the role hierarchy, specifically in how institution administrator and Site staff roles interact across institutional boundaries (CWE-284: Improper Access Control). Multi-tenanted deployments segregate data and users by institution; the flaw allows a Site staff member who also holds an institution administrator role to assume identities of members in sibling institutions without proper authorization checks. This is a privilege escalation issue rooted in inadequate scope enforcement between administrative role checks and user impersonation mechanisms.
RemediationAI
Upgrade to Mahara 24.04.10 or later for the 24.04 branch, or upgrade to Mahara 25.04.1 or later for the 25.x branch. The vendor advisory at https://mahara.org/interaction/forum/topic.php?id=9851 contains detailed patch information and deployment guidance. As a temporary workaround for organizations unable to patch immediately, restrict Site staff role assignment to only those users who also legitimately require institution administrator privileges across all institutions, and implement role audit logging to detect suspicious impersonation attempts. Note that this workaround weakens intended multi-tenancy segregation and is not a long-term substitute for patching.
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write o
Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when
Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
Arbitrary kernel memory read/write in Realtek rtl819x Jungle SDK Wi-Fi driver allows local unprivileged attackers to acc
Denial of service in GPAC's MP4Box/libgpac media importer (versions before 26.02.0) lets an attacker crash the tool by s
An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library) at commit 61f42d allows attackers to crash a process by ge
An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library implementation, commit 61f42d) lets attackers crash a proce
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today