Skip to content
Sign in
5.3 Medium

CVE-2026-113702 iomad PDF Certificate lib.php local_iomad_pluginfile authorization

Description

A security flaw has been discovered in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this vulnerability is the function local_iomad_pluginfile in the library public/local/iomad/lib.php of the component PDF Certificate Handler. The manipulation results in authorization bypass. The attack can be launched remotely. The patch is identified as ac7427130865ce0ed80870813317c87ae3060fa4/7bf0b10199782e04aa579e9d516e473b164afd1c/db903abdcb3aba124cce670608ae6d7ba5f51a84/66f7417c5357b7575e39e8be390602156c1a1225. It is advisable to implement a patch to correct this issue. This CVE was requested by the vendor.

CVSS 4.0 detail

Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X

Exploitable remotely over the network, with an ordinary account and without any user action; the impact on data or service is limited.

Attack vector
Network
Attack complexity
Low
Attack requirements
None
Privileges required
Low
Interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Confidentiality of other systems
None
Integrity of other systems
None
Availability of other systems
None

Affected products and versions

Product Affected versions Fixed in
iomad 5.2 5.2.0 → 5.2.4 No fix stated
iomad 5.1 5.1.0 → 5.1.8 No fix stated
iomad 5.0 5.0.0 → 5.0.11 No fix stated
iomad 4.5 4.5.0 → 4.5.15 No fix stated

Other CVEs of iomad

The 3 CVEs of iomad →
CVE-2026-124834 iomad Password Field company_user.php store_temporary_password information disclosure 6.3 Medium CVE-2026-1517 A vulnerability was identified in iomad up to 5.0 5.1 Medium
Track this CVE