Moodle CVE-2026-102584

Requires a valid authenticated low-privileged Moodle account (PR:L) with network access to the site; no additional user interaction is needed. Exploitation targets the grade-penalty recalculation function, which is missing its server-side capability check - so any authenticated user who can reach that endpoint can trigger it regardless of their assigned role. Limiting factors: the attacker must already have credentials on the Moodle instance, and impact is confined to integrity of grade-penalty records / assessment scores (no data disclosure or service disruption). Sites that do not use the grade-penalty feature have reduced exposure.

This is a genuine but low-to-moderate priority issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N = 4.3) tells a coherent, self-consistent story: network-reachable, low attack complexity, requires an authenticated low-privileged account (PR:L, no user interaction), and delivers integrity-only impact (I:L) with no confidentiality or availability effect - consistent with an authorization/capability-check gap (CWE-425, missing capability check) rather than a memory-safety or auth-bypass-to-admin flaw. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so per precision rules exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC data provided. The realistic ceiling of harm is that any enrolled/authenticated user (e.g. a student) could trigger a grade-penalty recalculation and skew assessment scores - an integrity concern for academic accuracy but not a system compromise. Note one metadata tension: the input Tags label this 'Authentication Bypass,' which is inaccurate - the flaw is an authorization/capability-check failure for an already-authenticated user (the CWE is CWE-425 and the vector is PR:L), so it does not bypass authentication.

A student or other low-privileged authenticated Moodle user sends a crafted request to the grade-penalty recalculation endpoint that lacks the required capability check, forcing a recalculation they should not be permitted to run. This alters stored grade-penalty records and thereby changes assessment scores. No public exploit code is identified, but the flaw requires only a valid low-privilege account and no user interaction, making it trivial to attempt once discovered.