What is the CVSS score of CVE-2026-30884?

CVE-2026-30884 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Moodle Mod Customcert are affected by CVE-2026-30884?

CVE-2026-30884 is a critical privilege escalation flaw in Moodle's Custom Certificate module that allows authenticated teachers to access and modify certificate data across the entire installation,…. A patch is available.

How to fix or mitigate CVE-2026-30884?

Within 24 hours: inventory all Moodle installations and identify affected versions (4.4.0-4.4.8 and 5.0.0-5.0.2). Within 7 days: upgrade to patched versions (4.4.9 or 5.0.3 minimum) or disable mod/customcert until patching is complete; audit certificate access logs for unauthorized modifications. Within 30 days: conduct forensic review of certificate data for tampering or disclosure, reset affected certificate contents if integrity cannot be confirmed, and implement access control monitoring on certificate management functions.

Moodle Mod Customcert CVE-2026-30884

EUVD-2026-12745 CRITICAL

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-03-18 GitHub_M

Information Disclosure Authentication Bypass Moodle Mod Customcert

9.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 14:52 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:50 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

4.4.9,5.0.3

EUVD ID Assigned

Mar 18, 2026 - 03:30 euvd

EUVD-2026-12745

Analysis Generated

Mar 18, 2026 - 03:30 vuln.today

CVE Published

Mar 18, 2026 - 02:26 nvd

CRITICAL 9.6

DescriptionGitHub Advisory

mdjnelson/moodle-mod_customcert is a Moodle plugin for creating dynamically generated certificates with complete customization via the web browser. Prior to versions 4.4.9 and 5.0.3, a teacher who holds mod/customcert:manage in any single course can read and silently overwrite certificate elements belonging to any other course in the Moodle installation. The core_get_fragment callback editelement and the mod_customcert_save_element web service both fail to verify that the supplied elementid belongs to the authorized context, enabling cross-course information disclosure and data tampering. Versions 4.4.9 and 5.0.3 fix the issue.

AnalysisAI

Cross-course privilege escalation in Moodle Mod Customcert allows authenticated teachers with certificate management rights in any course to read and modify certificate data across the entire Moodle installation due to missing context validation in the editelement callback and save_element web service. An attacker with mod/customcert:manage permissions in a single course can exploit this to disclose sensitive certificate information from other courses or tamper with their certificate elements. Versions 4.4.9 and 5.0.3 patch the vulnerability, but no patch is currently available for affected versions.

Technical ContextAI

This vulnerability affects the mdjnelson/moodle-mod_customcert plugin (CPE: cpe:2.3:a:mdjnelson:moodle-mod_customcert), a Moodle module written in PHP that enables dynamic certificate generation with web-based customization. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), where the core_get_fragment callback 'editelement' and the mod_customcert_save_element web service fail to verify that a supplied elementid parameter belongs to the authorized context. This allows an attacker to manipulate the elementid parameter to reference certificate elements from courses they should not have access to, breaking Moodle's context-based permission model. The vulnerability demonstrates a classic Insecure Direct Object Reference (IDOR) pattern where user-supplied identifiers are trusted without proper authorization checks against the current security context.

RemediationAI

Upgrade the mdjnelson/moodle-mod_customcert plugin to version 4.4.9 or later for the 4.x branch, or to version 5.0.3 or later for the 5.x branch. The fixes are documented in commits a1494a80fb953f187f7888a7394cbf9d13c28468 and ddc8f01f1e19fb61202f6013a38ef757486d3ba0 available at https://github.com/mdjnelson/moodle-mod_customcert/commit/a1494a80fb953f187f7888a7394cbf9d13c28468 and https://github.com/mdjnelson/moodle-mod_customcert/commit/ddc8f01f1e19fb61202f6013a38ef757486d3ba0. If immediate patching is not possible, consider temporarily disabling the customcert module or restricting the mod/customcert:manage capability to only highly trusted users while conducting an audit of certificate elements for unauthorized modifications. Review the full security advisory at https://github.com/mdjnelson/moodle-mod_customcert/security/advisories/GHSA-8pjr-j7r4-ccjx for additional context.