CVEvulnerability
CVE-2026-102583
2.7 LOW
Official page ↗
- Status
- Analyzed
- Published
- 2026-09-30
- Last modified
- 2026-10-01
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 2.7 LOW — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
- Weaknesses
- CWE-425
Description
A flaw was found in Moodle. An incorrect capability check in the artificial intelligence (AI) editor placement's image generation web service allows an authenticated user to invoke the feature without holding the required capability. This flaw permits unauthorized users to access and utilize the AI image generation functionality.
Affected configurations
• moodle moodle (< 4.5.13)
• moodle moodle (>= 5.0.0 < 5.0.9)
• moodle moodle (>= 5.1.0 < 5.1.6)
• moodle moodle (>= 5.2.0 < 5.2.2)
Related
Weakness · CWE (1)
- CWE-425 Direct Request weakness
References
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88587 Patch
- https://access.redhat.com/security/cve/CVE-2026-102583 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2543640 Issue Tracking, Third Party Advisory
- https://moodle.org/mod/forum/discuss.php?d=482501 Vendor Advisory