CVE-2022-29585: Mahara

High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days.

In Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0, a site using Isolated Institutions is vulnerable if more than ten groups are used. They are all shown from page 2 of the group results list (rather than only being shown for the institution that the viewer is a member of).

Affected products

• Mahara Mahara: before 20.10.5 (fixed in 20.10.5); from 21.04.0, before 21.04.4 (fixed in 21.04.4); from 21.10.0, before 21.10.2 (fixed in 21.10.2); version 22.04.0 only

Published 2022-04-28. Last modified 2026-06-17.