CVE-2011-2774: Mahara

Medium severity, CVSS 4.0. EPSS: 1% chance of exploitation in the next 30 days.

The "Reply to message" feature in Mahara 1.3.x and 1.4.x before 1.4.1 allows remote authenticated users to read the messages of a different user via a modified replyto parameter.

Affected products

• Mahara Mahara: version 1.3.0 only; version 1.3.1 only; version 1.3.2 only; version 1.3.3 only; version 1.3.4 only; version 1.3.5 only; …

Published 2011-11-15. Last modified 2026-06-16.