EUVD-2026-89726
GHSA-c8cf-cphr-fgxh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as Moodle manager
-
DeliveryOpen user list filter interface
-
ExploitFilter on restricted profile field values
-
ExecutionObserve matching-user results
-
ImpactInfer hidden profile data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V6 - Authentication Response uniformity
|
| Exploitation Conditions | Requires an authenticated account with Moodle manager privileges (PR:H) - this is not exploitable by anonymous or ordinary authenticated users. The specific weakness is that user-list filters do not enforce the same profile-field visibility restrictions applied to direct profile viewing, so the manager can filter on fields they are barred from reading and infer values from the results. No user interaction from a victim is needed and no special non-default configuration is indicated; the limiting factor is the elevated role prerequisite, which confines this to insider or compromised-manager scenarios and yields inferred data only, not bulk direct export. |
| Impact | This is a low-severity information-disclosure issue whose signals are internally consistent and point to minimal real-world urgency. The vendor CVSS 3.1 score is 2.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N): network-reachable but requiring high privileges (manager role) and yielding only limited confidentiality impact with no integrity or availability effect. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the provided data - so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision framework data was supplied. The one modest amplifier is that the flaw is an inference/oracle weakness (CWE-204): rather than a direct read, a privileged user infers restricted profile field values by filtering user lists, which is subtle and may evade audit review. Nothing here conflicts, but note the CVSS attack vector is AV:N while the practical precondition is a trusted manager account already inside the platform - the network vector reflects the web UI, not anonymous reach. Overall this is a genuinely low priority, not a high-CVSS-but-low-risk mismatch; the score already reflects the real risk. |
| Exploit ScenarioDerived | A user holding Moodle manager privileges applies user-list filters keyed on profile fields they are not authorized to view directly (e.g., a hidden custom field). By observing which users match a given filter value, the manager infers the hidden field contents for those accounts. No public exploit code is available, and the attacker must already possess an elevated Moodle role. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Moodle user-list filters do not enforce the same profile-field visibility restrictions that are applied when a profile is viewed directly, so an authenticated user holding manager privileges can filter user listings on hidden profile attributes and infer their values from the results returned. The issue is low severity, assessed at CVSS 3.1 base score 2.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N), and is limited to information disclosure - there is no integrity or availability impact and no code execution path. The elevated manager role is the gating prerequisite, so the flaw is not reachable by anonymous visitors or ordinary authenticated users, and no public exploit code has been identified at time of analysis.
RemediationAI
The primary fix is the upstream change tracked by MDL-87518; patch status is best described as an upstream fix available via the referenced commit, with the released patched version not independently confirmed from this dataset, so verify the exact fixed point release for your Moodle branch against moodle.org/mod/forum/discuss.php?d=482506 and https://access.redhat.com/security/cve/CVE-2026-102587 before upgrading. For deployments consuming Moodle from Fedora or Red Hat channels, follow the Red Hat advisory and Bugzilla 2543642 for the backported package versions rather than assuming upstream version numbers map cleanly. If patching is deferred, the most effective compensating control is to shrink the attack surface at the role level: audit and minimize manager role assignments and remove unnecessary user-list and profile-related capabilities from that role, accepting the trade-off that legitimate administrative workflows may break for any capability you revoke. Where the instance enables Moodle action logging, monitor user-list and user-browse filtering activity for repeated or systematic pattern-based queries by manager accounts, with the caveat that this is detective only and depends on logging being enabled and reviewed. Restricting site administration and participant-list endpoints to trusted networks at the web server or reverse proxy layer is a further option, with the trade-off of blocking legitimate remote administration. There is no anonymous-reachable path, so perimeter hardening should be treated as secondary to role minimization and patching.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Moodle's user browsing and filtering subsystem, which powers the participant list and the administrator user-list views. Moodle applies per-field visibility rules when rendering a user profile, but those rules are not consistently applied to the profile fields offered as filter criteria, creating an asymmetry between what a manager can read directly and what they can probe indirectly. The root cause class is CWE-204 (Observable Response Discrepancy), a side-channel/inference weakness in which responses differ depending on the value of data the requester is not authorized to observe, allowing values to be reconstructed by querying rather than by reading. The assessed CVSS vector confirms remote network reachability (AV:N), no special attack complexity (AC:L), a high privilege requirement (PR:H) consistent with the manager role, no victim interaction (UI:N), unchanged scope (S:U), and low confidentiality impact (C:L) with none to integrity or availability. Because each request yields incremental inference, this permits gradual reconstruction of hidden profile data rather than a bulk direct export, and no non-default configuration is indicated as a precondition.
Know when Moodle gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Manager role required (PR:H), exploited over the web UI (AV:N/AC:L) with no victim interaction; only limited confidentiality via inference (C:L), no integrity or availability impact.
Primary rating from Vendor (fedora).
CVSS VectorVendor: fedora
DescriptionCVE.org
A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure by inferring hidden user data.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell
A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. Rated critical severi
A flaw was found in Moodle. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authenticatio
In Moodle 2.x and 3.x, SQL injection can occur via user preferences. Rated critical severity (CVSS 9.8), this vulnerabil
The Moodle LMS Jmol plugin version 6.1 and earlier contains a path traversal vulnerability in jsmol.php. The query param
Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, an
Unrestricted file upload vulnerability in the double extension support in the "image" module in Moodle 3.1.2 allows remo
Unrestricted file upload vulnerability in the "legacy course files" and "file manager" modules in Moodle 3.1.2 allows re
moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional re
An issue was discovered in Moodle 3.x. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low a
Moodle 3.1.2 allows remote attackers to obtain sensitive information via unspecified vectors, related to a "SQL Injectio
Moodle 3.10.3 contains a persistent cross-site scripting vulnerability in the calendar event subtitle field that allows
Exploit-DB