CVE-2026-119555
Received Received - Intake

Information Disclosure in Moodle Core Grades Web Service

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain an information disclosure vulnerability in the core_grades_get_feedback web service. The service lacks group-membership and enrolment checks, so non-editing teachers can iterate userid values to read other groups' grade feedback and users' names and identity fields such as email.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119555
EUVD
EUVD-2026-113820

Affected Vendors & Products

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Moodle versions 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0. It is an information disclosure issue in the core_grades_get_feedback web service. The service does not verify group membership or enrollment, allowing non-editing teachers to access other groups' grade feedback and users' personal information like names and email addresses by iterating through user IDs.

Impact Analysis

If you are a non-editing teacher using a vulnerable Moodle version, an attacker could exploit this to view sensitive information such as grade feedback and personal details of other users in different groups. This could lead to privacy breaches and unauthorized access to confidential data.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to personal and sensitive data. GDPR requires protection of personal data, and HIPAA mandates safeguards for protected health information. Exploitation of this flaw may result in data breaches, violating these regulations and potentially leading to legal penalties.

Mitigation Strategies

Update Moodle to the latest patched version to address the information disclosure vulnerability in the core_grades_get_feedback web service.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119555. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart