External risk intelligence

Mahara LTI Unauthorized Access Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-42163

Mahara is a web-based ePortfolio system commonly deployed as a public-facing web application for students and staff. Because LTI integrations are frequently used to connect external learning tools to these web platforms, the vulnerable functionality is often reachable via the internet in standard educational deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in Mahara, an ePortfolio system, that could allow unauthorized access to internal accounts through Learning Tools Interoperability. Given its critical severity and potential for external exploitation, it is important to confirm if your organization utilizes Mahara and has LTI integrations enabled.

Unauthorized account access through learning tool links.
Affects educational systems using Mahara for portfolios.
Confirm relevance and exposure to Mahara LTI integrations.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by leveraging Learning Tools Interoperability (LTI) connections to gain unauthorized access to internal Mahara accounts. This could occur under specific configurations of LTI 1.1 and LTI 1.3 Advantage, potentially allowing an unauthenticated attacker to access sensitive user data.

Exposed LTI interface.
LTI connection and configuration.
Unauthorized account access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to gain unauthorized access to internal Mahara accounts when the system is configured to use Learning Tools Interoperability (LTI) 1.1 or LTI 1.3 Advantage. This could lead to the exposure or modification of user data and system behavior.

Internal Mahara accounts could be accessed.
Exploitation may occur via LTI configurations.
Unauthorized access and data modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Mahara, a web-based e-portfolio system. Application owners, in conjunction with platform or infrastructure teams, should first identify all Mahara instances, confirm LTI integration usage, and assess reachability and criticality. Subsequently, coordinated remediation planning with vendor management and security teams is necessary.

Application owners should own the issue.
Verify LTI integration and reachability first.
Plan coordinated remediation with vendor.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Mahara and how is it used?

Mahara is an open-source web-based ePortfolio system designed for students, educators, and professionals to create and share digital evidence of their learning and development. It functions as a platform where users manage files, blogs, and resumes. Organizations often deploy it as a public-facing web application so that users can access their portfolios from anywhere, often integrating it with other educational software via LTI protocols.

How does CVE-2026-42163 affect account security?

This vulnerability is classified as CWE-284, which concerns Improper Access Control. In the context of this CVE, the software fails to properly verify or restrict access requests coming through Learning Tools Interoperability (LTI) interfaces. This weakness allows an unauthenticated user to bypass standard login security and gain unauthorized access to internal accounts within the Mahara platform.

Do I need LTI enabled for this vulnerability to be triggered?

Yes. The vulnerability specifically involves the Learning Tools Interoperability (LTI) implementation in Mahara versions before 25.04.5 and 26.04.0. It occurs when LTI 1.1 or 1.3 Advantage features are in use. If your Mahara instance does not have LTI integration configured or enabled, this specific path to unauthorized account access is not present.

Why is this CVE considered high risk for my infrastructure?

According to Halo Surface Signal, this vulnerability is particularly concerning because Mahara is typically deployed as a public-facing web application. Since LTI integrations are common in educational environments to link various tools, the vulnerable interface is often reachable directly from the internet, increasing the likelihood that an attacker could attempt to exploit the access control flaw remotely.

How should I respond if my organization uses Mahara?

Start by identifying all deployed instances of Mahara within your network to determine which ones are running affected versions. Next, verify if LTI 1.1 or 1.3 Advantage is currently enabled. If these features are active, work with your IT or security team to plan an update to a patched version, ensuring you coordinate closely with your vendor to maintain system stability during the remediation process.

References

mahara.org/interaction/forum/topic.php?id=10077

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.