CVE-2026-102583

EUVD-2026-89722
A flaw was found in Moodle. An incorrect capability check in the artificial intelligence (AI) editor placement's image generation web service allows an authenticated user to invoke the feature without holding the required capability. This flaw permits unauthorized users to access and utilize the AI image generation functionality.
Forced Browsing
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
2.7 LOW
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 15.42%
Affected Products (NVD)
VendorProductVersion
moodlemoodle
𝑥
< 4.5.13
moodlemoodle
5.0.0 ≤
𝑥
< 5.0.9
moodlemoodle
5.1.0 ≤
𝑥
< 5.1.6
moodlemoodle
5.2.0 ≤
𝑥
< 5.2.2
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
moodle
bionic
needs-triage
jammy
dne
noble
dne
resolute
dne
xenial
needs-triage
Common Weakness Enumeration
References
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88587
https://access.redhat.com/security/cve/CVE-2026-102583
https://bugzilla.redhat.com/show_bug.cgi?id=2543640
https://moodle.org/mod/forum/discuss.php?d=482501