Moodle Mod Customcert CVE-2026-30884

Requires Moodle with mod_customcert plugin versions prior to 4.4.9 or 5.0.3. Attacker must be authenticated as a teacher holding mod/customcert:manage capability in at least one course. No victim interaction needed. Exploits missing authorization checks in core_get_fragment callback and mod_customcert_save_element web service to access certificate elements across courses.

The real-world risk is high due to multiple converging factors. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C) indicates network-exploitable attacks with low complexity requiring only low privileges (teacher role) and no user interaction, with scope change indicating impact beyond the vulnerable component's security context. The Changed scope (S:C) is particularly significant as it allows cross-course boundary violations in multi-tenant Moodle installations. While no EPSS score or KEV status is provided in the intelligence data, the combination of low attack complexity, readily available teacher accounts in educational institutions, and confirmed patch commits (a1494a80fb and ddc8f01f1e) demonstrating the fix implementation suggest this is exploitable by moderately skilled attackers. The GitHub Security Advisory (GHSA-8pjr-j7r4-ccjx) provides detailed disclosure, potentially enabling proof-of-concept development. Organizations running Moodle with multiple courses and the customcert plugin should prioritize this as a critical remediation item, particularly in multi-tenant educational environments where course isolation is a fundamental security boundary.

A malicious teacher with the mod/customcert:manage permission in Course A discovers certificate element IDs used in Course B through parameter enumeration or social engineering. They craft requests to the editelement callback or mod_customcert_save_element web service with the Course B element IDs, successfully reading sensitive certificate template information (such as organizational signatures, seals, or credential formats) and silently modifying certificate elements to insert fraudulent information, alter grading criteria visibility, or sabotage another instructor's course certificates. Since the attack vector is network-based with low complexity and no user interaction required, the attacker can automate cross-course reconnaissance and modification at scale across the entire Moodle installation.