Low
Moodle: arbitrary class instantiation via report builder audience classname
A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected application behavior.
Announced Group revision 1
Original source ↗CVE-2026-102580
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-102580
Structured affected-version data
Original package identities and version rules from this source.
[
{
"versions": [
{
"status": "affected",
"version": "5.2.0",
"lessThan": "5.2.2",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.1.0",
"lessThan": "5.1.6",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.0.0",
"lessThan": "5.0.9",
"versionType": "semver"
},
{
"status": "affected",
"version": "0",
"lessThan": "4.5.13",
"versionType": "semver"
}
],
"packageName": "moodle",
"collectionURL": "https://git.moodle.org",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-102580
Source reference:
/cveMetadata/cveId
Publisher severity
low
Source reference: /containers/cna/metrics
- Event
- #4399 · Revision 1
- Added to Heist Feed
- Publisher date