CVE-2026-119556
Received Received - Intake

Missing Capability Check in Moodle Exposes Hidden Grade Items

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the core_grades_get_gradeitems web service that allows enrolled students to view hidden grade items. Authenticated course users can call the AJAX or mobile web service to list hidden grade item ids, names, and categories that the gradebook conceals from them.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119556
EUVD
EUVD-2026-113821

Affected Vendors & Products

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Moodle versions 4.2.0 through 5.3.0 involves a missing capability check in the core_grades_get_gradeitems web service. It allows enrolled students to view hidden grade items, including their IDs, names, and categories, which are normally concealed from them in the gradebook.

Detection Guidance

Check Moodle logs for suspicious web service calls to core_grades_get_gradeitems by enrolled students. Review gradebook access patterns for unauthorized visibility of hidden grade items. Use Moodle admin tools to audit user permissions and web service access logs.

Impact Analysis

Authenticated course users, specifically enrolled students, can exploit this flaw to access sensitive grade information that should be hidden. This could lead to unauthorized disclosure of grades, undermining academic integrity and privacy.

Compliance Impact

This vulnerability may violate data protection regulations like GDPR or FERPA by exposing sensitive grade data to unauthorized users. It could lead to non-compliance with privacy requirements, resulting in legal or financial penalties for institutions.

Mitigation Strategies

Update Moodle to the latest patched version. Disable the core_grades_get_gradeitems web service if not required. Review and restrict user roles with access to gradebook services. Monitor for unusual activity in grade visibility.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119556. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart