mdjnelson moodle-mod_customcert up to 4.4.8/5.0.2 core_get_fragment editelement/mod_customcert_save_element authorization

Summaryinfo

A vulnerability was found in mdjnelson moodle-mod_customcert up to 4.4.8/5.0.2. It has been rated as critical. This affects the function core_get_fragment. This manipulation of the argument editelement/mod_customcert_save_element causes authorization. This vulnerability appears as CVE-2026-30884. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in mdjnelson moodle-mod_customcert up to 4.4.8/5.0.2 and classified as critical. Affected by this vulnerability is the function core_get_fragment. The manipulation of the argument editelement/mod_customcert_save_element with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

mdjnelson/moodle-mod_customcert is a Moodle plugin for creating dynamically generated certificates with complete customization via the web browser. Prior to versions 4.4.9 and 5.0.3, a teacher who holds `mod/customcert:manage` in any single course can read and silently overwrite certificate elements belonging to any other course in the Moodle installation. The `core_get_fragment` callback `editelement` and the `mod_customcert_save_element` web service both fail to verify that the supplied `elementid` belongs to the authorized context, enabling cross-course information disclosure and data tampering. Versions 4.4.9 and 5.0.3 fix the issue.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-30884 since 03/06/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 4.4.9 or 5.0.3 eliminates this vulnerability. Applying the patch a1494a80fb953f187f7888a7394cbf9d13c28468 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Learning Management Software

Vendor

• mdjnelson

Name

• moodle-mod_customcert

Version

• 4.4.0
• 4.4.1
• 4.4.2
• 4.4.3
• 4.4.4
• 4.4.5
• 4.4.6
• 4.4.7
• 4.4.8
• 5.0.0
• 5.0.1
• 5.0.2

License

• open-source

Website

• Product: https://github.com/mdjnelson/moodle-mod_customcert/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion