EUVD-2026-113821
GHSA-cr99-f6rx-jfq5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as enrolled course student
-
ExploitCall core_grades_get_gradeitems AJAX/mobile web service
-
ImpactEnumerate hidden grade item ids, names, and categories
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated account that is enrolled in the target Moodle course (PR:L); the attacker then invokes the core_grades_get_gradeitems web service via either the AJAX or the mobile endpoint. The course must contain grade items marked hidden in the gradebook for there to be anything to disclose. What LIMITS exploitation: valid credentials and course enrolment are mandatory (no anonymous/remote-unauthenticated path), and the disclosure is restricted to hidden grade item ids, names, and categories - not the grade values themselves. Affected deployments are Moodle 4.2.0-4.5.15, 5.0.0-5.0.11, 5.1.0-5.1.8, 5.2.0-5.2.4, and 5.3.0; no special non-default configuration is otherwise required. |
| Impact | This is a moderate-severity information-disclosure issue, not a high-priority emergency. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 5.3 and is consistent with the description: network-reachable, low-complexity, but requiring authenticated access (PR:L) by an already-enrolled course user. Impact is confined to confidentiality (VC:L; VI:N/VA:N), and even that is limited - the service leaks hidden grade item ids, names, and categories (metadata), not the actual grade values or other sensitive personal data. The vuln.today decision label is 'this_month', not 'act_now' or 'emergency', which aligns with the low-impact, authenticated-only nature. No CISA KEV entry is present and no EPSS score was supplied, so there is no signal of active or probable widespread exploitation. VulnCheck and third-party research (abraxaslabs) provide a public write-up and a source-code pointer, but the input does not confirm working exploit code. Net: a genuine authorization gap worth patching on a normal monthly cycle, but the combination of authenticated precondition, confidentiality-only metadata exposure, and absence of KEV/EPSS signals means it is not a drop-everything priority. |
| Exploit ScenarioDerived | An attacker who is a legitimately enrolled student in a Moodle course authenticates normally, then calls the core_grades_get_gradeitems web service (via the AJAX or mobile endpoint) for a course where the instructor has hidden certain grade items. Because the capability check is missing, the service returns the ids, names, and categories of grade items the gradebook is supposed to conceal. A public PoC reference exists (abraxaslabs research and the VulnCheck advisory); it is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Enrolled students on Moodle can call the core_grades_get_gradeitems web service and receive the IDs, names, and categories of grade items that the gradebook hides from them, because the external function performs no capability check before returning the data. Confirmed affected ranges are 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0, and exploitation requires only a valid account with enrolment in a course that actually contains hidden grade items. Disclosure is limited to hidden item metadata - grade values are not exposed - and there is no CISA KEV listing and no confirmed public exploit code at time of analysis, only a third-party research write-up and the upstream source location; the issue is scored 5.3 and assessed as a moderate-severity information-disclosure problem rather than an emergency.
RemediationAI
The supplied advisory data does not list a fixed release version, so the first step is to confirm the fix through the Moodle project's security announcements and the repository at https://github.com/moodle/moodle, and to upgrade to the earliest patched build published for each affected branch (4.2.x-4.5.x, 5.0.x, 5.1.x, 5.2.x and 5.3.0) as soon as those versions are identified; the vulnerable logic is at public/grade/classes/external/get_gradeitems.php lines 74-80 in v5.3.0, which is the place to verify whether an installed instance carries the missing capability check before and after patching. No workaround is described in the available sources, and the remediation is a code-level fix adding the authorization check, so interim risk is best managed by confirming exposure rather than by configuration changes: audit courses for hidden grade items (the only data the service can leak) and note that the disclosure is restricted to item IDs, names and categories, not grades. Where the disclosure window must be closed before a patch is available, restricting which accounts hold web services/mobile access tokens to the administrators and staff who genuinely need them reduces the number of callers who can reach the endpoint, at the cost of disabling app and AJAX workflows for students; the third-party research write-up at https://abraxaslabs.tech/research/moodle-grades-gradeitems and the VulnCheck advisory should be monitored for the vendor's fixed-version guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Moodle exposes functionality to clients through external functions registered in its web services layer, which can be reached from the browser via the AJAX endpoint and from the Moodle mobile app via the REST endpoint. The function at issue, core_grades_get_gradeitems, is implemented in public/grade/classes/external/get_gradeitems.php (the advisory reference points to lines 74-80 of the v5.3.0 tree), where the authorization step that external functions normally use to enforce a gradebook capability such as viewing hidden items is absent. That maps to CWE-862 (Missing Authorization): the code distinguishes an authenticated caller from an authorized one, so any user with a web services token who is enrolled in the course passes the only check that is performed. The practical consequence is enumeration of grade item identifiers, labels, and category assignments that the gradebook UI deliberately conceals, which is consistent with the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - network reachable, low complexity, but gated on an authenticated enrolled account and yielding only low-confidentiality metadata. The assessment explicitly limits impact: no grade values, no integrity or availability effect, and no anonymous path; the trigger as described is a direct service call rather than any complex state manipulation.
Know when Moodle gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Authenticated enrolled student (PR:L) over the network (AV:N) with low complexity and no user interaction; only hidden grade item metadata is exposed, so C:L with no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the core_grades_get_gradeitems web service that allows enrolled students to view hidden grade items. Authenticated course users can call the AJAX or mobile web service to list hidden grade item ids, names, and categories that the gradebook conceals from them.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell
A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. Rated critical severi
A flaw was found in Moodle. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authenticatio
In Moodle 2.x and 3.x, SQL injection can occur via user preferences. Rated critical severity (CVSS 9.8), this vulnerabil
The Moodle LMS Jmol plugin version 6.1 and earlier contains a path traversal vulnerability in jsmol.php. The query param
Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, an
Unrestricted file upload vulnerability in the double extension support in the "image" module in Moodle 3.1.2 allows remo
Unrestricted file upload vulnerability in the "legacy course files" and "file manager" modules in Moodle 3.1.2 allows re
moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional re
An issue was discovered in Moodle 3.x. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low a
Moodle 3.1.2 allows remote attackers to obtain sensitive information via unspecified vectors, related to a "SQL Injectio
Moodle 3.10.3 contains a persistent cross-site scripting vulnerability in the calendar event subtitle field that allows
Exploit-DB