CVE-2026-102587
lowA flaw was found in Moodle.
Vendor / product: Moodle — moodle
A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure by inferring hidden user data.
CVSS
2.7
2.7 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N Severity source: NVD CVSS v3.1 (patrick@puiterwijk.org)
Timeline (UTC)
Published: 2026-09-30 09:17
Modified: 2026-10-01 14:29
NVD status: Analyzed
Last synced 3 days ago
Verified against the source API 2026-10-27 06:56 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
moodle / moodle <4.5.13, ≥5.0.0 <5.0.9, ≥5.1.0 <5.1.6, ≥5.2.0 <5.2.2
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: https://moodle.org/mod/forum/discuss.php?d=482506
Patch / mitigation: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-87518
References
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-87518 patrick@puiterwijk.org
- https://access.redhat.com/security/cve/CVE-2026-102587 patrick@puiterwijk.org
- https://bugzilla.redhat.com/show_bug.cgi?id=2543642 patrick@puiterwijk.org
- https://moodle.org/mod/forum/discuss.php?d=482506 patrick@puiterwijk.org
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:56 UTC · record ↗