PT-2026-34880 · Mahara · Mahara

Published 2026-04-24 · Updated 2026-04-25 · CVE-2025-59308

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Mahara versions prior to 24.04.10 Mahara versions prior to 25.04.1

Description On multi-tenanted sites, an institution administrator or institution support administrator who also possesses the 'Site staff' role can masquerade as a member of an institution where they do not hold administrative privileges.

Recommendations Update to version 24.04.10 or later. Update to version 25.04.1 or later.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-59308

Affected Products

Mahara

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-59308 · Security Note
• https://mahara.org/interaction/forum/topic.php?id=9851 · Note
• https://twitter.com/CVEnew/status/2048099352086806817 · Twitter Post
• https://mahara.org · Note