CVE-2026-123655

{
  "etk_id": "ETK-2026-3720",
  "cve_id": "CVE-2026-123655",
  "display_id": "CVE-2026-123655",
  "ghsa_id": "GHSA-6fjj-67pc-89w4",
  "euvd_id": "EUVD-2026-118220",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Missing access control for Moodle H5P content files",
  "summary": "Moodle deployments with affected H5P content-file handling can expose materials that should be restricted, including content associated with unavailable or hidden course modules. An unauthenticated remote party may obtain that content when the affected files are reachable through Moodle.",
  "mitigation": "Upgrade Moodle to 4.5.15, 5.0.11, 5.1.8, or 5.2.4, as appropriate for the deployed release line. Restrict public access to the Moodle service until the update is applied if immediate patching is not possible.",
  "vendor": null,
  "product": "moodle",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.5.0, < 4.5.15",
        ">= 5.0.0, < 5.0.11",
        ">= 5.1.0, < 5.1.8",
        ">= 5.2.0, < 5.2.4"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "4.5.15",
        "5.0.11",
        "5.1.8",
        "5.2.4"
      ],
      "package_name": "moodle",
      "purl": null
    }
  ],
  "cwes": [
    862
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 40.3350745,
  "t0_at": "2026-11-06T11:45:43.719000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-06T11:45:43.719000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-06T11:45:43.719000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-123655"
    }
  }
}