CVE-2026-113607 in Configurable Reports Plugin
Summary
by MITRE • 10/20/2026
Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the block_configurable_reports_get_report_data web service. When check_permissions fails, the function only adds a warning and still returns the full report table, letting any logged-in user supply arbitrary report ids to read SQL reports over user and grade data.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/20/2026
The Configurable Reports block within Moodle versions prior to 5.3.0 contains a critical authorization bypass vulnerability that undermines the intended access control mechanisms for sensitive educational data. This flaw resides specifically in the web service function named block_configurable_reports_get_report_data, which is designed to retrieve and display report tables based on user-supplied identifiers. The core technical deficiency lies in how the system handles permission validation failures. Instead of enforcing strict denial when authorization checks fail, the implementation merely logs a warning message while proceeding to execute the query and return the complete data table to the requester. This logic error effectively neutralizes the security boundary, allowing any authenticated user to bypass restrictions intended for administrators or specific roles with elevated privileges.
From an operational perspective, this vulnerability enables unauthorized access to SQL reports that contain highly sensitive information, including detailed student records, personal identifiable information, and academic performance metrics such as grades. An attacker who has obtained valid credentials can exploit this flaw by supplying arbitrary report identifiers in their requests. Because the system fails to verify whether the requesting user actually possesses the necessary permissions for those specific reports, it blindly returns the data regardless of access rights. This represents a significant breach of confidentiality and integrity within the learning management environment, potentially exposing private student information to any individual with an account on the platform.
In terms of industry standard classifications, this vulnerability aligns closely with CWE-285, which describes Improper Authorization, as the application fails to enforce proper access controls for specific resources. Furthermore, it maps to ATT&CK technique T1078, Valid Accounts, since exploitation requires initial authentication but leverages a flaw in subsequent authorization checks rather than credential theft or brute force attacks. The ability to read restricted reports over user and grade data also touches upon CWE-200, Information Exposure, due to the unauthorized disclosure of sensitive internal information that was not intended for public or general student access.
Mitigation strategies must prioritize immediate patching to version 5.3.0 or later where this logic error has been corrected to enforce strict denial on permission failures. In environments where upgrading is not immediately feasible, administrators should restrict web service access by disabling the block_configurable_reports_get_report_data endpoint for all users except those with explicit administrative privileges. Additionally, implementing robust input validation and ensuring that authorization checks are treated as hard stops rather than soft warnings will prevent similar logic flaws in other modules. Regular auditing of web service configurations and continuous monitoring for anomalous data retrieval patterns can further reduce the risk of exploitation while permanent fixes are deployed.