CVE-2026-113607
Awaiting Analysis Awaiting Analysis - Queue

Authorization Bypass in Moodle Configurable Reports Block

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: VulnCheck

Description
Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the block_configurable_reports_get_report_data web service. When check_permissions fails, the function only adds a warning and still returns the full report table, letting any logged-in user supply arbitrary report ids to read SQL reports over user and grade data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-11-10
AI Q&A
2026-10-20
EPSS Evaluated
2026-11-08
NVD
CVE-2026-113607
EUVD
EUVD-2026-105085

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jleyva moodle-block_configurablereports 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in the Configurable Reports block for Moodle versions before 5.3.0. It allows authenticated users to read restricted reports through the block_configurable_reports_get_report_data web service. When permission checks fail, the system only adds a warning but still returns the full report data, enabling unauthorized access to sensitive information like user and grade data.

Detection Guidance

Check Moodle plugin version for configurable_reports. If version is below 5.3.0, the vulnerability likely exists. Inspect web service calls to block_configurable_reports_get_report_data for improper permission handling. Look for unauthorized report data access in logs.

Impact Analysis

This vulnerability allows any logged-in user to access restricted reports and view sensitive data such as user information and grades. Attackers could exploit this to steal confidential data, leading to privacy breaches or unauthorized data exposure within the Moodle system.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing sensitive personal data without authorization. GDPR requires strict access controls and data protection, while HIPAA mandates safeguards for protected health information. A breach could result in legal penalties and reputational damage.

Mitigation Strategies

Upgrade the Configurable Reports plugin to version 5.3.0 or later immediately. If upgrading is not possible, disable the plugin or restrict access to the get_report_data web service until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113607. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...