CVE-2026-102582

EUVD-2026-89721
A flaw was found in Moodle. The manual enrolment management page did not properly check whether the manual enrolment plugin was disabled, allowing users with enrolment permissions to access the page directly by navigating to its URL. Consequently, an authorized user could manage manual enrolments even after an administrator disabled the feature in the user interface.
Forced Browsing
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
2.2 LOW
NETWORK
HIGH
HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 9.36%
Affected Products (NVD)
VendorProductVersion
moodlemoodle
𝑥
< 4.5.13
moodlemoodle
5.0.0 ≤
𝑥
< 5.0.9
moodlemoodle
5.1.0 ≤
𝑥
< 5.1.6
moodlemoodle
5.2.0 ≤
𝑥
< 5.2.2
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
moodle
bionic
needs-triage
jammy
dne
noble
dne
resolute
dne
xenial
needs-triage
Common Weakness Enumeration
References
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88593
https://access.redhat.com/security/cve/CVE-2026-102582
https://bugzilla.redhat.com/show_bug.cgi?id=2543636
https://moodle.org/mod/forum/discuss.php?d=482500