CVE-2026-119555 in Moodle
Summary
by MITRE • 10/30/2026
Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain an information disclosure vulnerability in the core_grades_get_feedback web service. The service lacks group-membership and enrolment checks, so non-editing teachers can iterate userid values to read other groups' grade feedback and users' names and identity fields such as email.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The identified security flaw resides within the Moodle learning management system's core_grades_get_feedback web service interface across multiple version ranges including 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, and 5.2.0 through 5.2.4 as well as the initial release of version 5.3.0. This vulnerability constitutes a critical failure in access control logic where the service endpoint does not adequately enforce group membership or course enrollment restrictions before returning sensitive data. The core issue is an insecure direct object reference mechanism that allows authenticated users with limited privileges, specifically non-editing teachers, to bypass intended security boundaries by manipulating input parameters related to user identification.
From a technical perspective, the vulnerability stems from the absence of proper authorization checks within the web service handler for grade feedback retrieval. When a request is made to fetch feedback associated with a specific student or course group, the system fails to verify that the requesting teacher has legitimate access rights to view information belonging to other groups or users outside their assigned scope. This oversight enables an attacker who possesses valid credentials as a non-editing teacher to perform iterative enumeration of user identifiers such as userid values. By systematically varying these parameters in subsequent requests, the attacker can extract grade feedback data along with personally identifiable information including full names and email addresses for students across different groups or courses where they should not have visibility.
The operational impact of this vulnerability is significant due to the nature of the exposed data. Grade feedback often contains qualitative assessments that may reveal sensitive insights into a student's performance, behavioral issues, or personal circumstances. Coupled with identity fields like email addresses and names, this information disclosure facilitates potential phishing campaigns, social engineering attacks, or targeted harassment against students. Furthermore, the ability to enumerate valid user identifiers aids in building comprehensive profiles of individuals within an educational institution, which can be leveraged for further malicious activities such as credential stuffing or reconnaissance prior to more severe intrusions. This scenario aligns with CWE-200 Information Exposure and CWE-862 Missing Authorization, highlighting a fundamental breakdown in the principle of least privilege where users are granted access beyond their necessary operational requirements.
In terms of threat modeling, this vulnerability maps directly to MITRE ATT&CK technique T1530 Data from Cloud Storage Object or more broadly to data exfiltration via API abuse under techniques like T1213 Data from Information Repositories if the web service is considered a repository for institutional records. The attack vector involves authenticated exploitation where the adversary leverages legitimate access tokens but abuses their functional permissions through parameter manipulation rather than exploiting software bugs in code execution or memory management. This distinction emphasizes that even properly configured systems with valid credentials are susceptible to logic flaws when business rules regarding data segregation are not strictly enforced at the application layer.
To mitigate this vulnerability, administrators must upgrade Moodle to a patched version where these authorization checks have been implemented and validated by developers. Until an update is applied, temporary mitigations include restricting access to the affected web service endpoints via network-level controls such as firewall rules or reverse proxy configurations if feasible within the deployment architecture. Additionally, auditing existing user roles ensures that non-editing teachers do not possess unnecessary permissions related to grade management unless explicitly required for their pedagogical duties. Implementing strict input validation and enforcing group-based access control lists on all data retrieval operations will prevent unauthorized iteration of user identifiers and ensure that feedback remains confined to authorized educational contexts only.