Moodle CVE-2026-102580

Exploitation requires an authenticated Moodle account that holds the capability to create or manage Report Builder audiences (the flaw lives in the Report Builder component's audience-class handling), so ordinary students or self-registered users cannot reach it - this is the PR:H limiter. The attacker must additionally supply a class name that defeats the component's audience-class validation and instantiates into something with effect, which the vendor rates as high complexity (AC:H). No user interaction by a victim is needed (UI:N), and the vector is network-reachable via the normal Moodle web interface, but the realistic risk is bounded to sites where semi-privileged report authors are untrusted. Impact is limited to integrity (unexpected internal objects / application behavior); no confidentiality or availability effect is described.

This is a low-real-risk issue despite being a code-instantiation flaw. The provided CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N = 2.2 Low) is internally consistent and credible: exploitation requires high privileges (PR:H - access to Report Builder audience configuration, a capability normally held by managers/course creators, not ordinary users), high attack complexity (AC:H - the attacker must find a class-name value that both bypasses Moodle's audience allowlist validation and instantiates into something meaningful), and yields only limited integrity impact (I:L) with no confidentiality or availability loss. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the provided data; exploitation status is therefore 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The CWE-470 (unsafe reflection / arbitrary class instantiation) classification does raise the theoretical ceiling - reflection flaws can sometimes escalate to object-injection or RCE - but the description explicitly limits the outcome to 'unauthorized creation of internal program objects' and 'unexpected application behavior,' and both NVD and the vendor scored it as merely I:L with no RCE claim. No signals conflict; every indicator (privileged access, high complexity, minimal impact, no exploitation evidence) points the same direction: real but very low priority. One caveat: the reported CWE-470 and the input Tag 'Authentication Bypass' disagree - the tag mischaracterizes an unsafe-reflection integrity bug.

An authenticated Moodle user who already holds Report Builder audience-management privileges crafts a report and supplies a malicious, non-whitelisted PHP class name as the audience class. Because the class name is instantiated without proper validation, the platform constructs an unintended internal object, producing unexpected application state or behavior. No public exploit code is available, and the high privilege requirement means the attacker must already be a trusted report author.