CVE-2026-102587

Published: Sep 30, 2026Modified: Oct 1, 2026

2.7

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Exploitability: 1.2 / Impact: 1.4

Source: patrick@puiterwijk.org (Secondary)

Description

A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure by inferring hidden user data.

Affected (4)

Products: Moodle: Moodle

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Moodle Moodle	version < 4.5.13
Moodle Moodle	5.0.0 ≤ version < 5.0.9
Moodle Moodle	5.1.0 ≤ version < 5.1.6
Moodle Moodle	5.2.0 ≤ version < 5.2.2

Related CWEs

Observable Response Discrepancy

The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

References (4)

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-87518

Source: patrick@puiterwijk.org

Patch

https://access.redhat.com/security/cve/CVE-2026-102587

Source: patrick@puiterwijk.org

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2543642

Source: patrick@puiterwijk.org

Issue TrackingThird Party Advisory

https://moodle.org/mod/forum/discuss.php?d=482506

Source: patrick@puiterwijk.org

Vendor Advisory

Timeline

No history available yet.