CVE-2026-102580 PUBLISHED

Moodle: arbitrary class instantiation via report builder audience classname

Assigner: fedora
Reserved: 29.09.2026 Published: 30.09.2026 Updated: 30.09.2026

A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected application behavior.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
CVSS Score: 2.2

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	None
Privileges Required	High	Integrity Impact	Low
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Package Collection	https://git.moodle.org
Package Name	moodle
Versions	Default: unaffected affected from 5.2.0 to 5.2.2 (excl.) affected from 5.1.0 to 5.1.6 (excl.) affected from 5.0.0 to 5.0.9 (excl.) affected from 0 to 4.5.13 (excl.)

Credits

Upstream acknowledges Paul Holden as the original reporter.

References

Problem Types

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') CWE