Moodle EUVD-2026-89722

Requires an authenticated Moodle account on an instance where the AI subsystem and its editor-placement image-generation web service are enabled/configured. The attacker specifically does NOT need the capability that normally gates image generation - that missing enforcement is the vulnerability. Limiting factors: valid authentication is mandatory (no anonymous exploitation), the AI image-generation placement must be available/configured on the site, and impact is restricted to unauthorized use of the AI feature (potential AI-provider quota/cost abuse and minor integrity), with no path to data disclosure or code execution.

This is a low-real-risk authorization flaw despite being a network-facing web-service issue. The vendor CVSS of 2.7 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) already scores it near the bottom, and the impact is confined to a single low integrity metric (I:L) with no confidentiality or availability impact - the only consequence is that a user who lacks the required Moodle capability can still invoke the AI editor's image-generation web service. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so there is no signal of active or automatable exploitation; per the precision rules this is 'no public exploit identified at time of analysis.' One conflict is worth flagging: the vendor sets PR:H, but the described flaw is a capability-check bypass whose entire point is that a LOWER-privileged authenticated user reaches functionality they should not - that argues for PR:L, which would raise the score modestly (~4.3). Either way the outcome is minor (unauthorized use / resource-and-quota abuse of an AI feature, not data theft or code execution), so this remains a low priority best handled by routine patching rather than emergency response.

An authenticated Moodle user who does not hold the capability normally required to generate AI images crafts a direct request to the AI editor placement's image-generation web service endpoint; because the capability check is incorrect, the request is accepted and the user consumes the AI image-generation feature (and any associated third-party AI credits/quota) without authorization. No public exploit code is identified at time of analysis, and only a valid low-level account is needed.