CVE-2026-102587

EUVD-2026-89726
A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure by inferring hidden user data.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
2.7 LOW
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 15.04%
Affected Products (NVD)
VendorProductVersion
moodlemoodle
𝑥
< 4.5.13
moodlemoodle
5.0.0 ≤
𝑥
< 5.0.9
moodlemoodle
5.1.0 ≤
𝑥
< 5.1.6
moodlemoodle
5.2.0 ≤
𝑥
< 5.2.2
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
moodle
bionic
needs-triage
jammy
dne
noble
dne
resolute
dne
xenial
needs-triage
Common Weakness Enumeration
References
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-87518
https://access.redhat.com/security/cve/CVE-2026-102587
https://bugzilla.redhat.com/show_bug.cgi?id=2543642
https://moodle.org/mod/forum/discuss.php?d=482506