Moodle EUVD-2026-89724

Requires an authenticated account holding the teacher role in the Moodle instance (PR:L). Exploitation is triggered through the enrol-user-into-course-with-group workflow: the attacker supplies a group identifier that belongs to a course other than the one they are authorized to manage, and the application fails to verify that the group actually belongs to that course. No end-user interaction is needed (UI:N) and no special non-default configuration is required - any standard Moodle deployment with the grouping/enrolment feature is affected. The principal limiting factor is the teacher-privilege prerequisite, which restricts this to insiders or compromised teacher accounts and caps impact at limited group-membership integrity.

This is a genuine but low-severity authorization flaw (CWE-842, Placement into Incorrect Group). The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N = 4.3) is internally consistent with the description: network-reachable, low complexity, but requiring authenticated teacher-level privileges (PR:L) and yielding only a limited integrity impact (I:L) - the attacker can add users to groups in courses they should not administer, but there is no direct confidentiality or availability loss. Exploitation signals are weak: no KEV listing, no EPSS score provided, and no public exploit code referenced (only the MDL tracker, Red Hat mirror, Bugzilla entry, and Moodle forum post). SSVC data is absent. In short, this is a low-real-risk, high-ubiquity-product issue rather than a priority: the ceiling on damage is limited group-membership manipulation by an already-privileged (teacher) insider, patched by upstream Moodle (MDL-88538). Note: because the flaw crosses a course/authorization boundary, a scope change (S:C) could arguably be justified, but the vendor-supplied vector uses S:U; the integrity-only impact keeps overall severity low regardless.

An authenticated user holding teacher privileges in at least one course crafts an enrolment-with-group request that references a group ID belonging to a different course they are not authorized to manage; because the application never validates that the selected group belongs to the target course, the user is added to that foreign group. No public exploit code has been identified at time of analysis, and the low complexity means it is trivially reproducible for any account with the teacher role.