CVEvulnerability

CVE-2026-102580

4.3 MEDIUM Published 2026-09-30 Modified 2026-10-01 Official page ↗
Status
Analyzed
Published
2026-09-30
Last modified
2026-10-01
Assigner
[email protected]
CVSS 3.1 ([email protected])
2.2 LOW — CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
CVSS 3.1 ([email protected])
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-470

Description

A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected application behavior.

Affected configurations

• moodle moodle (< 4.5.13) • moodle moodle (>= 5.0.0 < 5.0.9) • moodle moodle (>= 5.1.0 < 5.1.6) • moodle moodle (>= 5.2.0 < 5.2.2)

Related

Weakness · CWE (1)

  • CWE-470 Use of Externally-Controlled Input to Select Classes or Code weakness

References