Information Disclosure Vulnerability in Moodle Web Service

CVE-2026-119555

What is CVE-2026-119555?

An information disclosure vulnerability exists in the core_grades_get_feedback web service of Moodle, affecting various versions up to 5.3.0. This vulnerability allows unauthorized users, such as non-editing teachers, to exploit the lack of group membership and enrollment checks to access sensitive information. By iterating through user IDs, attackers can read feedback on grades, along with user names and identity fields, which may include email addresses. This poses a significant risk to user privacy and data confidentiality.

References