Information Disclosure Vulnerability in Moodle by Moodle Pty Ltd
CVE-2026-102579

4.3MEDIUM

Key Information:

Status
Vendor
CVE Published:
30 September 2026

What is CVE-2026-102579?

A flaw in Moodle's grade web service misconfigures capability checks, enabling authenticated students to access sensitive profile information of their peers enrolled in the same course, which they should not have permission to view. This vulnerability poses a serious risk of unauthorized information disclosure, undermining user privacy and data security.

References

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=...
https://access.redhat.com/security/cve/CVE-2026-102579
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2543633
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Upstream acknowledges Itamarperetz2c7cc5 as the original reporter.
.