Moodle CVE-2026-102588

Exploitation requires the specific XML grade import feature of Moodle's gradebook, which lacks CSRF/origin-token validation. The victim must be an authenticated Moodle user who holds grade-management capability (e.g., teacher, manager, or admin role) and must be induced (UI:R) to visit an attacker-controlled page while their Moodle session is active. The attacker themselves needs no Moodle account (PR:N) and no privileges - the forged request executes with the victim's authority. Limiting factors: success depends on social-engineering a specifically privileged user, the target's browser sending session cookies cross-site (partially mitigated by SameSite cookie defaults in modern browsers), and only grade integrity is affected - no confidentiality or availability impact.

This is a moderate, realistically-exploitable but constrained flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, base 6.5) correctly models a CSRF: the attacker is unauthenticated (PR:N) because the forged request rides the victim's authenticated session, but exploitation is gated behind user interaction (UI:R) - a Moodle user who already holds grade-management capability must be lured into loading attacker-controlled content while logged in. Impact is integrity-only (I:H, C:N/A:N): grades can be set or overwritten, with no data disclosure or availability loss. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so exploitation status is 'no public exploit identified at time of analysis' - there is no evidence of active exploitation or automation. There is no SSVC decision data in the input. Net: this is a genuine but targeted-social-engineering issue rather than a mass-scannable RCE; priority is medium, driven by Moodle's enormous install base and the reliability of CSRF once a privileged victim is phished, tempered by the required user interaction and the integrity-only scope. Note the CWE is CWE-346 (Origin Validation Error) rather than the more typical CWE-352 (CSRF); this is consistent with a missing CSRF-token/origin check and does not change the assessment.

An attacker crafts a malicious web page (or email link) that auto-submits a forged XML grade-import request to a target Moodle site. When a teacher or administrator with grade-management permissions is tricked into visiting it while logged in, the browser silently replays their session and the import executes, letting the attacker set or overwrite student grades. No public exploit code was identified, but CSRF against a missing-token endpoint is straightforward to weaponize; user interaction (the victim visiting the page) is required.