CVE-2026-119556 in Moodle
Summary
by MITRE • 10/30/2026
Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the core_grades_get_gradeitems web service that allows enrolled students to view hidden grade items. Authenticated course users can call the AJAX or mobile web service to list hidden grade item ids, names, and categories that the gradebook conceals from them.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified involves a critical access control flaw within the Moodle learning management system, specifically affecting versions 4.2.0 through 4.5.15, as well as all releases in the 5.x series up to version 5.3.0. This issue centers on the core_grades_get_gradeitems web service endpoint, which is designed to retrieve grade item information for authenticated users. The fundamental technical flaw lies in a missing capability check during the execution of this service call. While Moodle’s user interface and standard API calls typically enforce strict role-based access controls that hide sensitive data from unauthorized parties, this specific web service fails to verify whether the requesting user has the appropriate permissions to view grade items marked as hidden by instructors or administrators.
From a technical perspective, an authenticated course participant can exploit this deficiency by directly invoking the AJAX interface or the mobile web service associated with core_grades_get_gradeitems. By doing so, they bypass the standard frontend logic that filters out concealed data. The system returns detailed information about grade items that are explicitly configured to be invisible to students, including their internal identifiers, display names, and associations with specific course categories. This represents a classic case of broken access control where the backend service does not independently validate permissions against the user's role before returning sensitive dataset elements.
The operational impact of this vulnerability is significant for educational institutions relying on Moodle for secure assessment management. Hidden grade items are often used by educators to store draft grades, preliminary assessments, or data intended only for administrative review until a specific release date. The exposure of these details allows enrolled students to gain unauthorized visibility into academic evaluation processes that should remain confidential. This can lead to unfair advantages if students anticipate grading criteria or see partial scores before official publication. Furthermore, the disclosure of internal identifiers and category structures may aid attackers in mapping out course architectures for further exploitation attempts, such as targeted grade manipulation or social engineering attacks against faculty members who manage these hidden items.
This vulnerability aligns with CWE-284, which describes Improper Access Control, specifically highlighting failures where authorization checks are omitted or incorrectly implemented on sensitive functions. In the context of the MITRE ATT&CK framework, this behavior corresponds to T1078, Valid Accounts, as it leverages legitimate credentials to access restricted resources, and potentially T1530, Data from Cloud Storage Objects, if viewed through the lens of accessing data not intended for that user's scope. The attack vector is classified under Remote Code Execution or API Abuse depending on subsequent exploitation steps, but primarily falls under Privilege Escalation via Broken Access Control mechanisms within web applications.
To mitigate this risk, administrators must upgrade Moodle to a patched version where the core_grades_get_gradeitems service has been updated to include rigorous capability verification before returning grade item data. Until an update is applied, institutions should consider restricting access to the specific web services involved if possible through network-level controls or WAF rules that limit exposure of these endpoints to untrusted networks. Additionally, reviewing course configurations to ensure no critical sensitive grading information relies solely on frontend hiding mechanisms without backend enforcement is advisable. Regular audits of user roles and permissions within Moodle can help identify other potential areas where similar missing checks might exist across different modules and services.