CVE-2026-102584

EUVD-2026-89723
A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores.
Forced Browsing
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 10.02%
Affected Products (NVD)
VendorProductVersion
moodlemoodle
5.0.0 ≤
𝑥
< 5.0.9
moodlemoodle
5.1.0 ≤
𝑥
< 5.1.6
moodlemoodle
5.2.0 ≤
𝑥
< 5.2.2
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
moodle
bionic
needs-triage
jammy
dne
noble
dne
resolute
dne
xenial
needs-triage
Common Weakness Enumeration
References
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88585
https://access.redhat.com/security/cve/CVE-2026-102584
https://bugzilla.redhat.com/show_bug.cgi?id=2543637
https://moodle.org/mod/forum/discuss.php?d=482502