Mahara web-service tokens cross institution and service-group boundaries

Mahara is an e-portfolio and social learning platform. Institutions can contain users, groups, portfolios, and web-service connections. A token issued for one integration may therefore represent a path into user data that is not visible through the normal login page.

ZoomEye returned 878 matches for title="Mahara" on 2026-11-10 at 00:52 UTC. The application query returned zero, and the broad body query returned 774,953. The body number is not credible as a product count because the word can appear in unrelated content. The title count is a focused marker but still requires confirmation.

View the title measurement in ZoomEye. The query used page 1, page size 1, and sub_type=all.

Tokens belong to an institution and service group

The Mahara 26.04 manual says web-service accounts need the webservice authentication method in an institution where the user is a member. Accounts using that method cannot log in through the standard form. A service access token is associated with a service group, and administrators can manage the service and its access.

That design creates several identifiers that should match: the institution, the web-service account, the token, the service group, and the external application. A token that is valid but scoped to the wrong institution or service group can be a cross-tenant access path.

Inventory service accounts separately from interactive users. Record the institution, service group, external application, token owner, creation date, expiry, and last use. Remove tokens for retired integrations. Test whether disabling the account or removing the service method also revokes the token's practical access.

Sites and institutions need role review

Mahara's role documentation distinguishes site administrators from institution roles. Site staff hold a staff role across all institutions, while institution staff and administrators are scoped to one institution. A small number of powerful site roles can therefore sit above the tenant model.

Review who holds site-wide roles, who can manage institutions, and who can change web-service configuration. Test an institution administrator against another institution. The expected result is a denial, not a successful page that merely hides data in the navigation.

Portfolio sharing, groups, and collections add data-level permissions on top of the institution. A user may be a member of an institution but should not see another person's private portfolio. The web-service token should not flatten those controls into a broad administration view unless the integration genuinely needs that authority.

A measured review sequence

Start with the title query and a small authorized sample. Confirm the login page or version marker, then compare the candidate with internal asset records. The body signal is too broad for a production count. The zero app result means only that the tested fingerprint did not match.

For each owned Mahara instance, list institutions, web-service connections, service groups, and tokens. Review the external wwwroot and public key configured for each connection. Check whether an old integration still has a token after its owner has left or its service group has changed.

Test the application from an account in the wrong institution, the wrong group, and with a revoked token. Test the same service path after the token is regenerated. Keep the results with the asset record so a future administrator can see why the connection exists.

The useful conclusion

ZoomEye provides a repeatable external marker for Mahara deployments. It does not show whether a web-service token is active or which institution it reaches. The security work begins when the inventory reaches the service configuration.

The defensible goal is a token for one integration, one institution, and the minimum service group needed. Site-wide roles should be rare, web-service accounts should be documented, and retired connections should fail rather than persist as dormant authority.

References

• Mahara 26.04: Web services
• Mahara 26.04: Roles overview
• Mahara: Institutions
• ZoomEye title measurement for Mahara

Measurement metadata: 2026-11-10 00:52 UTC, sub_type=all, page 1, pagesize 1; title 878, app 0, broad body 774,953.