CVE-2013-4431: Mahara before 1.5.12, 1.6.x before 1.6.7, and 1.7.x before 1.7.3 does not properly prevent access to blocks...

Security readout for executives and security teams

Older Mahara installations allowed a logged-in user to alter blocks they should not control by changing the block identifier in an edit request. This is an integrity issue for portfolio or learning content, not a confirmed system takeover based on the supplied sources. Exposure is likely limited to organizations still running the listed older Mahara versions with user authentication enabled. The provided affected CPE data is incomplete, so inventory should rely on application version checks rather than product matching alone. Treat this as a cleanup priority for any internet-facing or broadly accessible Mahara deployment. Urgency increases where students, external users, or low-trust accounts can log in and modify content. Mitigation focus: Upgrade Mahara to 1.5.12, 1.6.7, 1.7.3, or a later supported release.; Check Mahara vendor guidance and release notes for branch-specific remediation details.; Review whether untrusted users can authenticate to affected Mahara instances..

Prepared

Jun 14, 2026, 14:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.