Moodle EUVD-2026-89721

Exploitation requires an authenticated Moodle user who already holds enrolment-management permissions (PR:H) in a course context, and is only meaningful once an administrator has disabled the manual enrolment plugin in the UI - the page fails to re-check that disabled state on direct access. It is limited by that pre-existing privileged role: an unauthenticated or ordinary user cannot exploit it, and the impact is confined to managing manual enrolments (integrity-only, I:L) rather than reading data or escalating privileges. No user interaction is needed (UI:N); the actor simply forces-browses to the management URL.

This is a low-real-risk issue despite being a legitimate access-control flaw. The NVD CVSS 3.1 base score is 2.2 (Low), with AV:N but AC:H, PR:H, and only I:L impact - no confidentiality or availability effect. All exploitation signals are quiet: no EPSS score is provided, the CVE is not in CISA KEV, and no proof-of-concept is referenced (no public exploit identified at time of analysis). The SSVC decision framework is not provided in the input. The practical impact is narrow: a user who already holds enrolment-management permissions can continue to manage MANUAL enrolments by navigating directly to the page URL even after an administrator disables the manual enrolment plugin in the UI - a policy/feature-toggle bypass (CWE-425, Direct Request / Forced Browsing), not a data breach or privilege escalation to an unprivileged actor. One conflict worth noting: NVD rates AC:H, but the description implies exploitation is trivial (simply browse to the URL), which argues for AC:L; this raises the score only marginally and does not change the Low classification. The 'Information Disclosure' tag is inaccurate - there is no confidentiality impact (C:N); the actual weakness is broken access control with a limited integrity effect.

An administrator disables the manual enrolment plugin site-wide expecting that all manual enrolment management is blocked. A teacher or manager who retains enrolment permissions instead types the manual enrolment management page URL directly into their browser and continues adding or removing manual enrolments, silently overriding the administrator's policy decision. No public exploit is required - the 'attack' is ordinary forced browsing by an already-privileged user.