Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN1033
_____________________________________________________________________

DATE                : 15/10/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Moodle versions prior to
                             5.2.4, 5.1.8, 5.0.11, 4.5.15.

====================================================================
https://moodle.org/mod/forum/discuss.php?d=482830
https://moodle.org/mod/forum/discuss.php?d=482831
_____________________________________________________________________


MSA-26-0044: Missing access checks on H5P content files
par Michael Hawkins, jeudi 15 octobre 2026, 02:27


Insufficient access checks on H5P content files could result in users,
including those who were not logged in, having access to view H5P
content they did not have permission to access.

Severity/Risk: 	Serious
Versions affected: 	5.2 to 5.2.3, 5.1 to 5.1.7, 5.0 to 5.0.10,
                         4.5 to 4.5.14 and earlier unsupported versions
Versions fixed: 	5.2.4, 5.1.8, 5.0.11 and 4.5.15
Reported by: 	Jari Vilkman
CVE identifier: 	Pending
Changes (main): 	https://github.com/moodle/moodle/commit/4b42ce4ed1d132214fd4b7d4b5f4f0387ec28a49
Tracker issue: 	MDL-89547 Missing access checks on H5P content files

_____________________________________________________________________


MSA-26-0045: Upgrade TinyMCE and PrismJS including security fixes
(upstream)
par Michael Hawkins, jeudi 15 octobre 2026, 02:28


The upstream TinyMCE and PrismJS libraries were upgraded, which
included security fixes for multiple XSS risks. Note: These security
issues did not appear to be exploitable in Moodle.

Severity/Risk: 	Minor
Versions affected: 	5.2 to 5.2.3
Versions fixed: 	5.2.4
Reported by: 	Huong Nguyen
CVE identifiers: 	CVE-2026-47759, CVE-2026-47761, CVE-2026-47762
Changes (main): 	https://github.com/moodle/moodle/compare/4b42ce4ed1d132214fd4b7d4b5f4f0387ec28a49...2e94cf1feb1ba524aa201ad00e689667ab2a8e58
Tracker issue: 	MDL-89591 Upgrade TinyMCE and PrismJS including security
                 fixes (upstream)

=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================