CVE-2026-102579 in Moodle
Summary
by MITRE • 09/30/2026
A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course that they should not have permission to view. This issue leads to unauthorized information disclosure.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified within the Moodle learning management system represents a critical failure in role-based access control mechanisms, specifically targeting the grade web service interface. As an authenticated student with valid credentials for a specific course instance, the attacker is able to exploit an incorrect capability check that fails to properly validate whether the requesting user has permission to view sensitive profile data of their peers. This flaw allows for unauthorized information disclosure by bypassing standard privacy settings and enrollment restrictions designed to isolate individual student records from one another within shared academic environments. The root cause lies in the server-side logic governing API requests, where the system incorrectly assumes that membership in a course grants broader access rights than intended, thereby neglecting granular permission checks required for accessing personal user attributes beyond basic grade submissions or public profile fields.
From a technical perspective, this vulnerability aligns with CWE-284 Improper Access Control and CWE-601 URL Redirection to Untrusted Destination if the data is subsequently exfiltrated via external services, though primarily it falls under CWE-798 Use of Hard-coded Credentials or more accurately CWE-269 Improvement of Privileges as it involves accessing resources without proper authorization. The attack vector requires low complexity and relies on authentication, meaning an attacker must first obtain valid student credentials through phishing, credential stuffing, or other means before exploiting this logic flaw. Once authenticated, the malicious actor can programmatically query the grade web service endpoints to retrieve detailed profile information of other students enrolled in the same course. This includes potentially sensitive data such as email addresses, phone numbers, institutional identifiers, and other personally identifiable information that is typically restricted by default privacy configurations or instructor-defined visibility settings.
The operational impact of this vulnerability extends beyond simple data leakage, posing significant risks to student privacy and institutional compliance with regulations such as FERPA in the United States or GDPR in Europe. The ability for one student to harvest profile details of their peers can facilitate targeted phishing campaigns, social engineering attacks, or harassment within the academic community. Furthermore, it undermines the integrity of the learning environment by eroding trust among users who expect their personal information to remain confidential unless explicitly shared with instructors or administrative staff. In large-scale deployments where thousands of students may be enrolled in common courses, this flaw could lead to mass data exposure if exploited systematically through automated scripts that iterate over user IDs associated with a specific course ID.
Mitigation strategies must focus on reinforcing the principle of least privilege within the Moodle codebase and ensuring strict validation at every layer of the application stack. Administrators should immediately apply any available security patches released by the Moodle project, which typically involve correcting the capability checks in the grade web service to verify that the requesting user has explicit permission to view specific profile fields for each target user ID. Additionally, implementing robust input validation and enforcing strict access control lists on API endpoints can prevent unauthorized data retrieval. Security teams should also monitor logs for unusual patterns of requests targeting multiple student profiles from a single authenticated session, which may indicate active exploitation attempts. Regular security audits focusing on role-based access controls are essential to identify similar logic flaws in other modules that handle sensitive user data.