Description
A flaw was found in Moodle. Insufficient access control checks on H5P content files allow unauthenticated remote attackers to view restricted materials, including content stored in the system context and files belonging to hidden or unavailable course modules. This issue results in unauthorized information disclosure of protected content.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | moodle | 4.5.0 – < 4.5.15, 5.0.0 – < 5.0.11, 5.1.0 – < 5.1.8, 5.2.0 – < 5.2.4 | 4.5.15 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | moodle | No fix yet | — |
| Ubuntu Pro 16.04 LTS | moodle | No fix yet | — |
Advisories 1
- WID-SEC-2026-4385 Moodle: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Nov 8, 2026