← Back

CVE-2026-102579

nvd nist
Published: Sep 30, 2026Modified: Oct 1, 2026

JSON object

Loading...
4.3
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Exploitability: 2.8 / Impact: 1.4
Source: patrick@puiterwijk.org (Secondary)

Description

A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course that they should not have permission to view. This issue leads to unauthorized information disclosure.

Affected (4)

Products: Moodle: Moodle
Moodle
1 product
Moodle
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Moodle
Moodle
version < 4.5.13
Moodle
5.0.0 ≤ version < 5.0.9
Moodle
5.1.0 ≤ version < 5.1.6
Moodle
5.2.0 ≤ version < 5.2.2

Related CWEs

CWE-359
Exposure of Private Personal Information to an Unauthorized Actor
The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

References (4)

Source: patrick@puiterwijk.org
Patch
Source: patrick@puiterwijk.org
Third Party Advisory
Source: patrick@puiterwijk.org
Issue TrackingThird Party Advisory
Source: patrick@puiterwijk.org
Vendor Advisory

Timeline

No history available yet.