Moodle Configurable Reports CVE-2026-113607

Exploitation requires (1) the Configurable Reports block plugin installed on a Moodle instance earlier than 5.3.0, (2) Moodle web services / the external API enabled so the block_configurable_reports_get_report_data function is reachable, and (3) any valid authenticated account (PR:L) - the attacker needs no elevated role, only a login. The concrete trigger is supplying arbitrary report ids to that web service, after which a failed check_permissions call previously added only a warning and still returned the full report table. Limiting factors that reduce realistic risk: authentication is mandatory (not anonymous), impact is confined to reading SQL report data over user and grade information (no write/integrity or availability effect), and instances that have web services disabled or have upgraded to 5.3.0 are not exposed.

This is a credible, moderate-priority authorization bypass (CWE-863) in the Configurable Reports block for Moodle. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) is internally consistent with the description: network-reachable web service, low attack complexity, and low-privilege authentication required, with confidentiality-only impact (user and grade data) and no integrity or availability effect. The source-code evidence strongly corroborates the root cause - the pre-patch code called get_string('badpermissions',...) to set only a warning and then still returned the full report table, while the fix replaces it with throw new moodle_exception('badpermissions',...), confirming the broken permission gate. Exploitation status is 'no public exploit identified at time of analysis' (not in CISA KEV; no POC referenced - only a patch commit and vendor advisory). EPSS is not provided, so probabilistic exploitation likelihood cannot be stated. The signals do not conflict: the confidentiality-only, PR:L profile matches the described 'any logged-in user can read restricted reports' behavior. Net: a real, confirmed-and-patched information-disclosure flaw worth prompt remediation on affected instances, but not an emergency given the authentication requirement, confidentiality-only impact, and absence of KEV/POC evidence.

A low-privilege authenticated Moodle user (e.g., a student) calls the block_configurable_reports_get_report_data web service and supplies report ids they are not authorized to view. Because the failed permission check only emitted a warning instead of aborting, the service returns the full report table, exposing other users' personal data and grades. No public exploit code is referenced, but the trivial attack complexity (AC:L) and the disclosed patch make the flaw easy to reproduce.