CVE-2022-24111: Mahara

Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days.

In Mahara 21.04 before 21.04.3 and 21.10 before 21.10.1, portfolios created in groups that have not been shared with non-group members and portfolios created on the site and institution levels can be viewed without requiring a login if the URL to these portfolios is known.

Affected products

• Mahara Mahara: from 21.04.0, before 21.04.3 (fixed in 21.04.3); version 21.10.0 only

Published 2022-02-10. Last modified 2026-06-17.