Authorization Bypass Vulnerability in Moodle's Configurable Reports Block
CVE-2026-113607

7.1HIGH

Key Information:

Vendor

Jleyva

Status
Moodle-block Configurablereports
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113607?

The Configurable Reports block for Moodle prior to version 5.3.0 is susceptible to an authorization bypass vulnerability. This issue allows authenticated users to access restricted reports via the block_configurable_reports_get_report_data web service. During a permissions check, if it fails, the system returns the full report without adequately restricting access, enabling any logged-in user to retrieve SQL reports potentially containing sensitive user and grade data by supplying arbitrary report IDs.

Affected Version(s)

moodle-block_configurablereports 0 < 5.3.0

References

https://github.com/jleyva/moodle-block_configurablereport...
patch
https://github.com/jleyva/moodle-block_configurablereport...
release-notes
https://github.com/jleyva/moodle-block_configurablereport...
technical-description

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Trần Văn Hoàng
.