CVE-2026-102579 PUBLISHED

Moodle: user profile information disclosure via grade web service

Assigner: fedora
Reserved: 29.09.2026 Published: 30.09.2026 Updated: 30.09.2026

A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course that they should not have permission to view. This issue leads to unauthorized information disclosure.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 4.3

Product Status

Package Collection https://git.moodle.org
Package Name moodle
Versions Default: unaffected
  • affected from 5.2.0 to 5.2.2 (excl.)
  • affected from 5.1.0 to 5.1.6 (excl.)
  • affected from 5.0.0 to 5.0.9 (excl.)
  • affected from 0 to 4.5.13 (excl.)

Credits

  • Upstream acknowledges Itamarperetz2c7cc5 as the original reporter.

References

Problem Types

  • Exposure of Private Personal Information to an Unauthorized Actor CWE