Missing Capability Check in Moodle's Gradebook Service

CVE-2026-119556

What is CVE-2026-119556?

Moodle versions 4.2.0 through 4.5.15, and 5.0.0 through 5.3.0 exhibit a security flaw in the core_grades_get_gradeitems web service. This vulnerability allows enrolled students to bypass hidden grade item restrictions, granting them unauthorized access to view grade item IDs, names, and categories that should be concealed. The absence of a proper capability check enables authenticated users to exploit this oversight through AJAX or mobile web service calls, posing a risk to the integrity of the gradebook.

References