CVE-2026-102579
Received Received - Intake

Incorrect Capability Check in Moodle Leads to Unauthorized Information Disclosure

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: Fedora Project

Description
A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course that they should not have permission to view. This issue leads to unauthorized information disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-102579
EUVD
EUVD-2026-89718

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
moodle moodle *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-359 The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in Moodle, a learning management system. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course without proper permission. This leads to unauthorized disclosure of private information.

Detection Guidance

To detect this vulnerability, monitor Moodle's grade web service logs for unauthorized access attempts to student profile information. Check for requests from authenticated students accessing data outside their permitted scope. Review capability checks in the grade web service code for improper validation. Use network monitoring tools to inspect traffic to the grade service endpoint for unusual patterns.

Impact Analysis

If you are a student using Moodle, your profile information could be accessed by other students in the same course without your consent. This exposes sensitive personal data, violating privacy expectations. Administrators may face reputational damage and potential legal consequences.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and potential failure to ensure data protection. For HIPAA, if Moodle is used in healthcare contexts, it could lead to breaches of protected health information, resulting in compliance violations and penalties.

Mitigation Strategies

Update Moodle to the latest version to ensure the capability check flaw is patched. Review and restrict access to the grade web service to prevent unauthorized access. Monitor user activity logs for suspicious access to student profiles.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102579. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart