CVEvulnerability
CVE-2026-102584
4.3 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2026-09-30
- Last modified
- 2026-10-01
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weaknesses
- CWE-425
Description
A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores.
Affected configurations
• moodle moodle (>= 5.0.0 < 5.0.9)
• moodle moodle (>= 5.1.0 < 5.1.6)
• moodle moodle (>= 5.2.0 < 5.2.2)
Related
Weakness · CWE (1)
- CWE-425 Direct Request weakness
References
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88585 Patch
- https://access.redhat.com/security/cve/CVE-2026-102584 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2543637 Issue Tracking, Third Party Advisory
- https://moodle.org/mod/forum/discuss.php?d=482502 Vendor Advisory