CVE-2026-102587
Received Received - Intake

Moodle User Profile Field Information Disclosure

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: Fedora Project

Description
A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure by inferring hidden user data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-102587
EUVD
EUVD-2026-89726

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
moodle moodle *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-204 The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in Moodle where user list filters do not enforce visibility restrictions on profile fields. A manager with privileges can filter users by profile attributes they are not allowed to view directly, which may lead to unauthorized disclosure of hidden user data through inference.

Impact Analysis

If you are a Moodle manager, this flaw could allow you to access restricted user profile information indirectly by filtering user lists based on fields you are not permitted to view. This may result in unauthorized exposure of sensitive user data.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of personal or sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations that mandate strict access controls and data protection measures.

Mitigation Strategies

Apply the latest Moodle security patches immediately to fix the user list filter flaw. Review and restrict manager privileges to prevent unauthorized filtering of profile fields. Monitor user activity logs for suspicious filtering attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102587. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart