CVE-2026-102584

Published: Sep 30, 2026Modified: Oct 1, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: patrick@puiterwijk.org (Secondary)

Description

A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores.

Affected (3)

Products: Moodle: Moodle

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Moodle Moodle	5.0.0 ≤ version < 5.0.9
Moodle Moodle	5.1.0 ≤ version < 5.1.6
Moodle Moodle	5.2.0 ≤ version < 5.2.2

Related CWEs

Direct Request ('Forced Browsing')

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

References (4)

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88585

Source: patrick@puiterwijk.org

Patch

https://access.redhat.com/security/cve/CVE-2026-102584

Source: patrick@puiterwijk.org

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2543637

Source: patrick@puiterwijk.org

Issue TrackingThird Party Advisory

https://moodle.org/mod/forum/discuss.php?d=482502

Source: patrick@puiterwijk.org

Vendor Advisory

Timeline

No history available yet.