EUVD-2026-89718
GHSA-q3h7-pfg7-m3c3
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection PII protection
|
| Impact | This is a genuine but low-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) is internally consistent with the description: a low-privileged authenticated student exploits an incorrect capability check in the grade web service to read profile data of co-enrolled students. Impact is confidentiality-only and limited (C:L), with no integrity or availability effect and no scope change. No EPSS score, KEV listing, POC, or SSVC decision data was provided; per precision rules this is 'no public exploit identified at time of analysis.' There are no conflicting signals - the vector matches the narrative. The primary drivers of any real-world concern are Moodle's very large deployment footprint and the low exploitation barrier for any enrolled user, not the severity of a single exploitation, which yields only limited personal-data leakage among course peers. Net: real but modest; patch on normal cadence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Information disclosure in Moodle's grade web service allows an authenticated student to view profile details of other students enrolled in the same course even though they lack the required capability. The issue is a low-severity confidentiality-only flaw (CVSS 4.3, CWE-359) reachable over the network with low attack complexity but requiring a valid student account. No public exploit code or confirmed active exploitation was identified in the provided data, and an upstream fix commit (MDL-89381) is referenced but a released patched version is not independently confirmed.
RemediationAI
Because the supplied data does not include an exact Moodle release version, the most specific guidance is to apply the upstream fix referenced by MDL-89381 and upgrade to the Moodle release that contains it; monitor the Moodle forum advisory at https://moodle.org/mod/forum/discuss.php?d=482497, the Red Hat CVE page at https://access.redhat.com/security/cve/CVE-2026-102579, and the Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2543633 for the fixed version. If immediate upgrade is not possible, a compensating control is to restrict student-role access to the grade web service or disable the affected grade web service functions until patched, but this may break legitimate grade sync, mobile app grade viewing, and reporting integrations. Also review Moodle role capabilities and web service enabled protocols, and monitor logs for unexpected calls to grade web service endpoints.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Moodle is a learning management system that exposes functionality through web services used by mobile apps, integrations, and external tools. The vulnerable component is the grade web service, which should enforce Moodle capability checks before returning user data. CWE-359 describes exposure of private personal information to unauthorized actors; here an incorrect capability check fails to prevent an authenticated student from accessing profile fields of other students in the same course. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N indicates remote exploitation with low complexity, requiring a low-privileged authenticated account, no user interaction, and resulting only in limited confidentiality impact with no integrity or availability impact. The vulnerability is genuine but low priority.
Know when Moodle gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (fedora) · only source for this CVE.
CVSS VectorVendor: fedora
DescriptionCVE.org
A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course that they should not have permission to view. This issue leads to unauthorized information disclosure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell
A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. Rated critical severi
A flaw was found in Moodle. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authenticatio
In Moodle 2.x and 3.x, SQL injection can occur via user preferences. Rated critical severity (CVSS 9.8), this vulnerabil
The Moodle LMS Jmol plugin version 6.1 and earlier contains a path traversal vulnerability in jsmol.php. The query param
Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, an
Unrestricted file upload vulnerability in the double extension support in the "image" module in Moodle 3.1.2 allows remo
Unrestricted file upload vulnerability in the "legacy course files" and "file manager" modules in Moodle 3.1.2 allows re
moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional re
An issue was discovered in Moodle 3.x. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low a
Moodle 3.1.2 allows remote attackers to obtain sensitive information via unspecified vectors, related to a "SQL Injectio
Moodle 3.10.3 contains a persistent cross-site scripting vulnerability in the calendar event subtitle field that allows
Exploit-DB