Medium
Moodle: group validation missing when enrolling user to course
A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses they do not have authorization to access.
Announced Group revision 1
Original source ↗CVE-2026-102585
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-102585
Structured affected-version data
Original package identities and version rules from this source.
[
{
"versions": [
{
"status": "affected",
"version": "5.2.0",
"lessThan": "5.2.2",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.1.0",
"lessThan": "5.1.6",
"versionType": "semver"
}
],
"packageName": "moodle",
"collectionURL": "https://git.moodle.org",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-102585
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #4486 · Revision 1
- Added to Heist Feed
- Publisher date