Moodle CVE-2026-119555

Requires a valid authenticated account with at least the non-editing teacher role (PR:L) on the target Moodle instance, and the core_grades_get_feedback external/web service must be reachable (as used by the Moodle mobile app or custom web-service clients). The flaw is present in default code because core_grades_get_feedback omits group-membership and enrolment checks, so no non-default configuration is needed once web services are in use; the attacker simply iterates the userid parameter. Limiting factors: exploitation is bounded to those holding teacher-level credentials (no anonymous/student-only path described), no user interaction is required, and impact is confined to reading other groups' grade feedback and identity fields (names, email) - there is no write, code-execution, or availability impact.

This is a moderate-severity information disclosure flaw (CVSS 4.0 base 5.3) whose real-world risk is tempered by its access requirements. The vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N shows network reach and low complexity, but PR:L means the attacker must already hold a valid low-privilege account - specifically a non-editing teacher role - so this is an authenticated/insider authorization bypass (IDOR, CWE-639), not an unauthenticated breach. Impact is narrow: VC:L/VI:N/VA:N reflects limited confidentiality loss (other groups' grade feedback plus names and identity fields such as email) with no integrity or availability impact. No EPSS score was provided in the input, so exploitation probability cannot be quantified; this is a data gap, not a signal of low likelihood. The vuln is not on CISA KEV (no active-exploitation signal), and no SSVC machine-readable decision string is provided - the only priority signal is the vuln.today 'this_month' decision label, consistent with a real-but-not-emergency issue. A public PoC reference exists (abraxaslabs research write-up) but it is not verified as working exploit code. Overall: a genuine access-control defect worth patching on a normal cycle, bounded by the need for teacher-level credentials and limited to PII/feedback disclosure rather than code execution or full account takeover.

A user holding a non-editing teacher account on a Moodle site invokes the core_grades_get_feedback web service and increments the userid parameter across values outside their own groups and enrolments. Because the service omits group-membership and enrolment checks, it returns grade feedback plus names and identity fields (including email) for students the teacher should not be able to see. A public PoC reference exists (abraxaslabs research); it is not verified as working exploit code.