CVE-2026-102583

Published: Sep 30, 2026Modified: Oct 1, 2026

2.7

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Exploitability: 1.2 / Impact: 1.4

Source: patrick@puiterwijk.org (Secondary)

Description

A flaw was found in Moodle. An incorrect capability check in the artificial intelligence (AI) editor placement's image generation web service allows an authenticated user to invoke the feature without holding the required capability. This flaw permits unauthorized users to access and utilize the AI image generation functionality.

Affected (4)

Products: Moodle: Moodle

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Moodle Moodle	version < 4.5.13
Moodle Moodle	5.0.0 ≤ version < 5.0.9
Moodle Moodle	5.1.0 ≤ version < 5.1.6
Moodle Moodle	5.2.0 ≤ version < 5.2.2

Related CWEs

Direct Request ('Forced Browsing')

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

References (4)

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88587

Source: patrick@puiterwijk.org

Patch

https://access.redhat.com/security/cve/CVE-2026-102583

Source: patrick@puiterwijk.org

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2543640

Source: patrick@puiterwijk.org

Issue TrackingThird Party Advisory

https://moodle.org/mod/forum/discuss.php?d=482501

Source: patrick@puiterwijk.org

Vendor Advisory

Timeline

No history available yet.