{"schema_version":"2","view":"grouped","data":[{"id":76340,"cve_ids":["CVE-2026-102579"],"payload":{"kind":"advisory","title":"Moodle: user profile information disclosure via grade web service","summary":"A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course that they should not have permission to view. This issue leads to unauthorized information disclosure.","evidence":"osv:BIT-moodle-2026-102579","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-moodle-2026-102579","aliases":["BIT-moodle-2026-102579","CVE-2026-102579"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.13"},{"introduced":"5.0.0"},{"fixed":"5.0.9"},{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102579.json"}}],"modified":"2026-10-05T14:30:08.332606191Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102579","https://bugzilla.redhat.com/show_bug.cgi?id=2543633","https://moodle.org/mod/forum/discuss.php?d=482497","https://nvd.nist.gov/vuln/detail/CVE-2026-102579"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-102579","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:d71c5d63-b73e-4a50-a84d-16fdde4ef513","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102579","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"products":[],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102579","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102579","advisory_id":"d71c5d63-b73e-4a50-a84d-16fdde4ef513","event_types":["advisory"],"published_at":"2026-10-26T22:38:56.789902+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:23.387+00:00","detail_url":"/advisories/advisory%3Ad71c5d63-b73e-4a50-a84d-16fdde4ef513","group":{"id":"advisory:d71c5d63-b73e-4a50-a84d-16fdde4ef513","revision":1,"primary_event_id":84221,"change":"published","superseded_by":[],"changed":{"id":84221,"cve_ids":["CVE-2026-102579"],"payload":{"kind":"advisory","title":"Moodle: user profile information disclosure via grade web service","summary":"A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course that they should not have permission to view. This issue leads to unauthorized information disclosure.","evidence":"osv:BIT-moodle-2026-102579","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-moodle-2026-102579","aliases":["BIT-moodle-2026-102579","CVE-2026-102579"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.13"},{"introduced":"5.0.0"},{"fixed":"5.0.9"},{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102579.json"}}],"modified":"2026-10-05T14:30:08.332606191Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102579","https://bugzilla.redhat.com/show_bug.cgi?id=2543633","https://moodle.org/mod/forum/discuss.php?d=482497","https://nvd.nist.gov/vuln/detail/CVE-2026-102579"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-102579","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:d71c5d63-b73e-4a50-a84d-16fdde4ef513","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102579","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"products":[],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102579","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102579","advisory_id":"d71c5d63-b73e-4a50-a84d-16fdde4ef513","event_types":["advisory"],"published_at":"2026-10-26T22:38:56.789902+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:23.387+00:00","detail_url":"/events/84221"},"members":[{"id":84221,"cve_ids":["CVE-2026-102579"],"payload":{"kind":"advisory","title":"Moodle: user profile information disclosure via grade web service","summary":"A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course that they should not have permission to view. This issue leads to unauthorized information disclosure.","evidence":"osv:BIT-moodle-2026-102579","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-moodle-2026-102579","aliases":["BIT-moodle-2026-102579","CVE-2026-102579"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.13"},{"introduced":"5.0.0"},{"fixed":"5.0.9"},{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102579.json"}}],"modified":"2026-10-05T14:30:08.332606191Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102579","https://bugzilla.redhat.com/show_bug.cgi?id=2543633","https://moodle.org/mod/forum/discuss.php?d=482497","https://nvd.nist.gov/vuln/detail/CVE-2026-102579"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-102579","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:d71c5d63-b73e-4a50-a84d-16fdde4ef513","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102579","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"products":[],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102579","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102579","advisory_id":"d71c5d63-b73e-4a50-a84d-16fdde4ef513","event_types":["advisory"],"published_at":"2026-10-26T22:38:56.789902+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:23.387+00:00","detail_url":"/events/84221"}]}},{"id":76334,"cve_ids":["CVE-2026-102577"],"payload":{"kind":"advisory","title":"Moodle: ssrf risk in url downloader via ipv4-mapped ipv6 address bypass","summary":"A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted destinations, leading to Server-Side Request Forgery (SSRF).","evidence":"osv:BIT-moodle-2026-102577","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-moodle-2026-102577","aliases":["BIT-moodle-2026-102577","CVE-2026-102577"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.13"},{"introduced":"5.0.0"},{"fixed":"5.0.9"},{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102577.json"}}],"modified":"2026-10-05T14:30:07.640583045Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102577","https://bugzilla.redhat.com/show_bug.cgi?id=2543604","https://moodle.org/mod/forum/discuss.php?d=482495","https://nvd.nist.gov/vuln/detail/CVE-2026-102577"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-102577","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:1dd573a9-e601-4e27-8399-eb9117cc98b5","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102577","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"products":[],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102577","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102577","advisory_id":"1dd573a9-e601-4e27-8399-eb9117cc98b5","event_types":["advisory"],"published_at":"2026-10-26T22:38:26.728751+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:20.779+00:00","detail_url":"/advisories/advisory%3A1dd573a9-e601-4e27-8399-eb9117cc98b5","group":{"id":"advisory:1dd573a9-e601-4e27-8399-eb9117cc98b5","revision":1,"primary_event_id":84186,"change":"published","superseded_by":[],"changed":{"id":84186,"cve_ids":["CVE-2026-102577"],"payload":{"kind":"advisory","title":"Moodle: ssrf risk in url downloader via ipv4-mapped ipv6 address bypass","summary":"A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted destinations, leading to Server-Side Request Forgery (SSRF).","evidence":"osv:BIT-moodle-2026-102577","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-moodle-2026-102577","aliases":["BIT-moodle-2026-102577","CVE-2026-102577"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.13"},{"introduced":"5.0.0"},{"fixed":"5.0.9"},{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102577.json"}}],"modified":"2026-10-05T14:30:07.640583045Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102577","https://bugzilla.redhat.com/show_bug.cgi?id=2543604","https://moodle.org/mod/forum/discuss.php?d=482495","https://nvd.nist.gov/vuln/detail/CVE-2026-102577"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-102577","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:1dd573a9-e601-4e27-8399-eb9117cc98b5","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102577","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"products":[],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102577","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102577","advisory_id":"1dd573a9-e601-4e27-8399-eb9117cc98b5","event_types":["advisory"],"published_at":"2026-10-26T22:38:26.728751+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:20.779+00:00","detail_url":"/events/84186"},"members":[{"id":84186,"cve_ids":["CVE-2026-102577"],"payload":{"kind":"advisory","title":"Moodle: ssrf risk in url downloader via ipv4-mapped ipv6 address bypass","summary":"A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted destinations, leading to Server-Side Request Forgery (SSRF).","evidence":"osv:BIT-moodle-2026-102577","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-moodle-2026-102577","aliases":["BIT-moodle-2026-102577","CVE-2026-102577"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.13"},{"introduced":"5.0.0"},{"fixed":"5.0.9"},{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102577.json"}}],"modified":"2026-10-05T14:30:07.640583045Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102577","https://bugzilla.redhat.com/show_bug.cgi?id=2543604","https://moodle.org/mod/forum/discuss.php?d=482495","https://nvd.nist.gov/vuln/detail/CVE-2026-102577"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-102577","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:1dd573a9-e601-4e27-8399-eb9117cc98b5","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102577","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"products":[],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102577","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102577","advisory_id":"1dd573a9-e601-4e27-8399-eb9117cc98b5","event_types":["advisory"],"published_at":"2026-10-26T22:38:26.728751+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:20.779+00:00","detail_url":"/events/84186"}]}},{"id":76330,"cve_ids":["CVE-2026-102586"],"payload":{"kind":"advisory","title":"Moodle: xss via password reset link due to insufficient username escaping","summary":"A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting (XSS) attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary script in the victim's browser.","evidence":"osv:BIT-moodle-2026-102586","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-moodle-2026-102586","aliases":["BIT-moodle-2026-102586","CVE-2026-102586"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.13"},{"introduced":"5.0.0"},{"fixed":"5.0.9"},{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102586.json"}}],"modified":"2026-10-05T14:30:07.632496950Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102586","https://bugzilla.redhat.com/show_bug.cgi?id=2543641","https://moodle.org/mod/forum/discuss.php?d=482504","https://nvd.nist.gov/vuln/detail/CVE-2026-102586"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-102586","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:c7b93066-a4a9-4094-b115-bea778ddb17f","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102586","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"products":[],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102586","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102586","advisory_id":"c7b93066-a4a9-4094-b115-bea778ddb17f","event_types":["advisory"],"published_at":"2026-10-26T22:37:26.773957+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:32.748+00:00","detail_url":"/advisories/advisory%3Ac7b93066-a4a9-4094-b115-bea778ddb17f","group":{"id":"advisory:c7b93066-a4a9-4094-b115-bea778ddb17f","revision":1,"primary_event_id":84162,"change":"published","superseded_by":[],"changed":{"id":84162,"cve_ids":["CVE-2026-102586"],"payload":{"kind":"advisory","title":"Moodle: xss via password reset link due to insufficient username escaping","summary":"A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting (XSS) attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary script in the victim's browser.","evidence":"osv:BIT-moodle-2026-102586","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-moodle-2026-102586","aliases":["BIT-moodle-2026-102586","CVE-2026-102586"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.13"},{"introduced":"5.0.0"},{"fixed":"5.0.9"},{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102586.json"}}],"modified":"2026-10-05T14:30:07.632496950Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102586","https://bugzilla.redhat.com/show_bug.cgi?id=2543641","https://moodle.org/mod/forum/discuss.php?d=482504","https://nvd.nist.gov/vuln/detail/CVE-2026-102586"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-102586","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:c7b93066-a4a9-4094-b115-bea778ddb17f","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102586","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"products":[],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102586","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102586","advisory_id":"c7b93066-a4a9-4094-b115-bea778ddb17f","event_types":["advisory"],"published_at":"2026-10-26T22:37:26.773957+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:32.748+00:00","detail_url":"/events/84162"},"members":[{"id":84162,"cve_ids":["CVE-2026-102586"],"payload":{"kind":"advisory","title":"Moodle: xss via password reset link due to insufficient username escaping","summary":"A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting (XSS) attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary script in the victim's browser.","evidence":"osv:BIT-moodle-2026-102586","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-moodle-2026-102586","aliases":["BIT-moodle-2026-102586","CVE-2026-102586"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.13"},{"introduced":"5.0.0"},{"fixed":"5.0.9"},{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102586.json"}}],"modified":"2026-10-05T14:30:07.632496950Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102586","https://bugzilla.redhat.com/show_bug.cgi?id=2543641","https://moodle.org/mod/forum/discuss.php?d=482504","https://nvd.nist.gov/vuln/detail/CVE-2026-102586"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-102586","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:c7b93066-a4a9-4094-b115-bea778ddb17f","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102586","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"products":[],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102586","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102586","advisory_id":"c7b93066-a4a9-4094-b115-bea778ddb17f","event_types":["advisory"],"published_at":"2026-10-26T22:37:26.773957+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:32.748+00:00","detail_url":"/events/84162"}]}},{"id":76326,"cve_ids":["CVE-2026-102584"],"payload":{"kind":"advisory","title":"Moodle: missing capability check allows unauthorised grade penalty recalculation","summary":"A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores.","evidence":"osv:BIT-moodle-2026-102584","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-moodle-2026-102584","aliases":["BIT-moodle-2026-102584","CVE-2026-102584"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.0.9"},{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102584.json"}}],"modified":"2026-10-05T14:30:06.978605025Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102584","https://bugzilla.redhat.com/show_bug.cgi?id=2543637","https://moodle.org/mod/forum/discuss.php?d=482502","https://nvd.nist.gov/vuln/detail/CVE-2026-102584"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-102584","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:568ed083-ab3c-4b62-9a2e-0c3e9a9a0c85","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102584","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"products":[],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102584","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102584","advisory_id":"568ed083-ab3c-4b62-9a2e-0c3e9a9a0c85","event_types":["advisory"],"published_at":"2026-10-26T22:37:23.061926+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:30.017+00:00","detail_url":"/advisories/advisory%3A568ed083-ab3c-4b62-9a2e-0c3e9a9a0c85","group":{"id":"advisory:568ed083-ab3c-4b62-9a2e-0c3e9a9a0c85","revision":1,"primary_event_id":84155,"change":"published","superseded_by":[],"changed":{"id":84155,"cve_ids":["CVE-2026-102584"],"payload":{"kind":"advisory","title":"Moodle: missing capability check allows unauthorised grade penalty recalculation","summary":"A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores.","evidence":"osv:BIT-moodle-2026-102584","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-moodle-2026-102584","aliases":["BIT-moodle-2026-102584","CVE-2026-102584"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.0.9"},{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102584.json"}}],"modified":"2026-10-05T14:30:06.978605025Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102584","https://bugzilla.redhat.com/show_bug.cgi?id=2543637","https://moodle.org/mod/forum/discuss.php?d=482502","https://nvd.nist.gov/vuln/detail/CVE-2026-102584"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-102584","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:568ed083-ab3c-4b62-9a2e-0c3e9a9a0c85","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102584","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"products":[],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102584","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102584","advisory_id":"568ed083-ab3c-4b62-9a2e-0c3e9a9a0c85","event_types":["advisory"],"published_at":"2026-10-26T22:37:23.061926+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:30.017+00:00","detail_url":"/events/84155"},"members":[{"id":84155,"cve_ids":["CVE-2026-102584"],"payload":{"kind":"advisory","title":"Moodle: missing capability check allows unauthorised grade penalty recalculation","summary":"A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores.","evidence":"osv:BIT-moodle-2026-102584","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-moodle-2026-102584","aliases":["BIT-moodle-2026-102584","CVE-2026-102584"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.0.9"},{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102584.json"}}],"modified":"2026-10-05T14:30:06.978605025Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102584","https://bugzilla.redhat.com/show_bug.cgi?id=2543637","https://moodle.org/mod/forum/discuss.php?d=482502","https://nvd.nist.gov/vuln/detail/CVE-2026-102584"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-102584","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:568ed083-ab3c-4b62-9a2e-0c3e9a9a0c85","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102584","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"products":[],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102584","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102584","advisory_id":"568ed083-ab3c-4b62-9a2e-0c3e9a9a0c85","event_types":["advisory"],"published_at":"2026-10-26T22:37:23.061926+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:30.017+00:00","detail_url":"/events/84155"}]}},{"id":76324,"cve_ids":["CVE-2026-102580"],"payload":{"kind":"advisory","title":"Moodle: arbitrary class instantiation via report builder audience classname","summary":"A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected application behavior.","evidence":"osv:BIT-moodle-2026-102580","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-moodle-2026-102580","aliases":["BIT-moodle-2026-102580","CVE-2026-102580"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.13"},{"introduced":"5.0.0"},{"fixed":"5.0.9"},{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102580.json"}}],"modified":"2026-10-05T14:30:06.975944388Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102580","https://bugzilla.redhat.com/show_bug.cgi?id=2543635","https://moodle.org/mod/forum/discuss.php?d=482498","https://nvd.nist.gov/vuln/detail/CVE-2026-102580"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-102580","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:aa8d53c8-bb3b-4b46-8a54-d6bcf4dbe324","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102580","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Low","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.2,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"products":[],"severity":"low","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102580","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102580","advisory_id":"aa8d53c8-bb3b-4b46-8a54-d6bcf4dbe324","event_types":["advisory"],"published_at":"2026-10-26T22:37:21.468139+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:24.688+00:00","detail_url":"/advisories/advisory%3Aaa8d53c8-bb3b-4b46-8a54-d6bcf4dbe324","group":{"id":"advisory:aa8d53c8-bb3b-4b46-8a54-d6bcf4dbe324","revision":1,"primary_event_id":84152,"change":"published","superseded_by":[],"changed":{"id":84152,"cve_ids":["CVE-2026-102580"],"payload":{"kind":"advisory","title":"Moodle: arbitrary class instantiation via report builder audience classname","summary":"A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected application behavior.","evidence":"osv:BIT-moodle-2026-102580","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-moodle-2026-102580","aliases":["BIT-moodle-2026-102580","CVE-2026-102580"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.13"},{"introduced":"5.0.0"},{"fixed":"5.0.9"},{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102580.json"}}],"modified":"2026-10-05T14:30:06.975944388Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102580","https://bugzilla.redhat.com/show_bug.cgi?id=2543635","https://moodle.org/mod/forum/discuss.php?d=482498","https://nvd.nist.gov/vuln/detail/CVE-2026-102580"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-102580","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:aa8d53c8-bb3b-4b46-8a54-d6bcf4dbe324","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102580","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Low","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.2,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"products":[],"severity":"low","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102580","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102580","advisory_id":"aa8d53c8-bb3b-4b46-8a54-d6bcf4dbe324","event_types":["advisory"],"published_at":"2026-10-26T22:37:21.468139+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:24.688+00:00","detail_url":"/events/84152"},"members":[{"id":84152,"cve_ids":["CVE-2026-102580"],"payload":{"kind":"advisory","title":"Moodle: arbitrary class instantiation via report builder audience classname","summary":"A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected application behavior.","evidence":"osv:BIT-moodle-2026-102580","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-moodle-2026-102580","aliases":["BIT-moodle-2026-102580","CVE-2026-102580"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.13"},{"introduced":"5.0.0"},{"fixed":"5.0.9"},{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102580.json"}}],"modified":"2026-10-05T14:30:06.975944388Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102580","https://bugzilla.redhat.com/show_bug.cgi?id=2543635","https://moodle.org/mod/forum/discuss.php?d=482498","https://nvd.nist.gov/vuln/detail/CVE-2026-102580"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-102580","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:aa8d53c8-bb3b-4b46-8a54-d6bcf4dbe324","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102580","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Low","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.2,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"products":[],"severity":"low","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102580","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102580","advisory_id":"aa8d53c8-bb3b-4b46-8a54-d6bcf4dbe324","event_types":["advisory"],"published_at":"2026-10-26T22:37:21.468139+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:24.688+00:00","detail_url":"/events/84152"}]}},{"id":76317,"cve_ids":["CVE-2026-102581"],"payload":{"kind":"advisory","title":"Moodle: xss in forum post templates due to insufficient escaping","summary":"A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting (XSS) vulnerability. An attacker can inject malicious content into a forum post, which then executes arbitrary script code in the browser of another user viewing the affected post.","evidence":"osv:BIT-moodle-2026-102581","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-moodle-2026-102581","aliases":["BIT-moodle-2026-102581","CVE-2026-102581"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.13"},{"introduced":"5.0.0"},{"fixed":"5.0.9"},{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102581.json"}}],"modified":"2026-10-05T14:30:06.376274089Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102581","https://bugzilla.redhat.com/show_bug.cgi?id=2543634","https://moodle.org/mod/forum/discuss.php?d=482499","https://nvd.nist.gov/vuln/detail/CVE-2026-102581"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-102581","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:7bac365f-6e5d-4456-ba35-2c5ba105bd3d","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102581","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.6,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"products":[],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102581","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102581","advisory_id":"7bac365f-6e5d-4456-ba35-2c5ba105bd3d","event_types":["advisory"],"published_at":"2026-10-26T22:36:27.924725+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:25.98+00:00","detail_url":"/advisories/advisory%3A7bac365f-6e5d-4456-ba35-2c5ba105bd3d","group":{"id":"advisory:7bac365f-6e5d-4456-ba35-2c5ba105bd3d","revision":1,"primary_event_id":84116,"change":"published","superseded_by":[],"changed":{"id":84116,"cve_ids":["CVE-2026-102581"],"payload":{"kind":"advisory","title":"Moodle: xss in forum post templates due to insufficient escaping","summary":"A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting (XSS) vulnerability. An attacker can inject malicious content into a forum post, which then executes arbitrary script code in the browser of another user viewing the affected post.","evidence":"osv:BIT-moodle-2026-102581","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-moodle-2026-102581","aliases":["BIT-moodle-2026-102581","CVE-2026-102581"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.13"},{"introduced":"5.0.0"},{"fixed":"5.0.9"},{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102581.json"}}],"modified":"2026-10-05T14:30:06.376274089Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102581","https://bugzilla.redhat.com/show_bug.cgi?id=2543634","https://moodle.org/mod/forum/discuss.php?d=482499","https://nvd.nist.gov/vuln/detail/CVE-2026-102581"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-102581","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:7bac365f-6e5d-4456-ba35-2c5ba105bd3d","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102581","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.6,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"products":[],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102581","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102581","advisory_id":"7bac365f-6e5d-4456-ba35-2c5ba105bd3d","event_types":["advisory"],"published_at":"2026-10-26T22:36:27.924725+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:25.98+00:00","detail_url":"/events/84116"},"members":[{"id":84116,"cve_ids":["CVE-2026-102581"],"payload":{"kind":"advisory","title":"Moodle: xss in forum post templates due to insufficient escaping","summary":"A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting (XSS) vulnerability. An attacker can inject malicious content into a forum post, which then executes arbitrary script code in the browser of another user viewing the affected post.","evidence":"osv:BIT-moodle-2026-102581","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-moodle-2026-102581","aliases":["BIT-moodle-2026-102581","CVE-2026-102581"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.13"},{"introduced":"5.0.0"},{"fixed":"5.0.9"},{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102581.json"}}],"modified":"2026-10-05T14:30:06.376274089Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102581","https://bugzilla.redhat.com/show_bug.cgi?id=2543634","https://moodle.org/mod/forum/discuss.php?d=482499","https://nvd.nist.gov/vuln/detail/CVE-2026-102581"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-102581","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:7bac365f-6e5d-4456-ba35-2c5ba105bd3d","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102581","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.6,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"products":[],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102581","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102581","advisory_id":"7bac365f-6e5d-4456-ba35-2c5ba105bd3d","event_types":["advisory"],"published_at":"2026-10-26T22:36:27.924725+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:25.98+00:00","detail_url":"/events/84116"}]}},{"id":76303,"cve_ids":["CVE-2026-102585"],"payload":{"kind":"advisory","title":"Moodle: group validation missing when enrolling user to course","summary":"A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses they do not have authorization to access.","evidence":"osv:BIT-moodle-2026-102585","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-moodle-2026-102585","aliases":["BIT-moodle-2026-102585","CVE-2026-102585"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102585.json"}}],"modified":"2026-10-05T14:30:05.476129986Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102585","https://bugzilla.redhat.com/show_bug.cgi?id=2543639","https://moodle.org/mod/forum/discuss.php?d=482503","https://nvd.nist.gov/vuln/detail/CVE-2026-102585"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-102585","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:0bca56ed-143f-43bc-b94e-b75f76ef76df","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102585","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"products":[],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102585","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102585","advisory_id":"0bca56ed-143f-43bc-b94e-b75f76ef76df","event_types":["advisory"],"published_at":"2026-10-26T22:36:17.276065+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:31.39+00:00","detail_url":"/advisories/advisory%3A0bca56ed-143f-43bc-b94e-b75f76ef76df","group":{"id":"advisory:0bca56ed-143f-43bc-b94e-b75f76ef76df","revision":1,"primary_event_id":84028,"change":"published","superseded_by":[],"changed":{"id":84028,"cve_ids":["CVE-2026-102585"],"payload":{"kind":"advisory","title":"Moodle: group validation missing when enrolling user to course","summary":"A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses they do not have authorization to access.","evidence":"osv:BIT-moodle-2026-102585","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-moodle-2026-102585","aliases":["BIT-moodle-2026-102585","CVE-2026-102585"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102585.json"}}],"modified":"2026-10-05T14:30:05.476129986Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102585","https://bugzilla.redhat.com/show_bug.cgi?id=2543639","https://moodle.org/mod/forum/discuss.php?d=482503","https://nvd.nist.gov/vuln/detail/CVE-2026-102585"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-102585","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:0bca56ed-143f-43bc-b94e-b75f76ef76df","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102585","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"products":[],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102585","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102585","advisory_id":"0bca56ed-143f-43bc-b94e-b75f76ef76df","event_types":["advisory"],"published_at":"2026-10-26T22:36:17.276065+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:31.39+00:00","detail_url":"/events/84028"},"members":[{"id":84028,"cve_ids":["CVE-2026-102585"],"payload":{"kind":"advisory","title":"Moodle: group validation missing when enrolling user to course","summary":"A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses they do not have authorization to access.","evidence":"osv:BIT-moodle-2026-102585","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-moodle-2026-102585","aliases":["BIT-moodle-2026-102585","CVE-2026-102585"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102585.json"}}],"modified":"2026-10-05T14:30:05.476129986Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102585","https://bugzilla.redhat.com/show_bug.cgi?id=2543639","https://moodle.org/mod/forum/discuss.php?d=482503","https://nvd.nist.gov/vuln/detail/CVE-2026-102585"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-102585","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:0bca56ed-143f-43bc-b94e-b75f76ef76df","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102585","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"products":[],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102585","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102585","advisory_id":"0bca56ed-143f-43bc-b94e-b75f76ef76df","event_types":["advisory"],"published_at":"2026-10-26T22:36:17.276065+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:31.39+00:00","detail_url":"/events/84028"}]}},{"id":76301,"cve_ids":["CVE-2026-102578"],"payload":{"kind":"advisory","title":"Moodle: sql injection in question bank web service","summary":"A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL (Structured Query Language) injection vulnerability. This issue could allow an attacker to view, alter, or delete sensitive data stored in the underlying database.","evidence":"osv:BIT-moodle-2026-102578","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"BIT-moodle-2026-102578","aliases":["BIT-moodle-2026-102578","CVE-2026-102578"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.13"},{"introduced":"5.0.0"},{"fixed":"5.0.9"},{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102578.json"}}],"modified":"2026-10-05T14:30:05.475104106Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102578","https://bugzilla.redhat.com/show_bug.cgi?id=2543632","https://moodle.org/mod/forum/discuss.php?d=482496","https://nvd.nist.gov/vuln/detail/CVE-2026-102578"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"High"}},"related_cves":[{"value":"CVE-2026-102578","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:afa4a461-afe0-41f1-bcf5-871dc7234e35","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102578","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"products":[],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102578","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102578","advisory_id":"afa4a461-afe0-41f1-bcf5-871dc7234e35","event_types":["advisory"],"published_at":"2026-10-26T22:36:16.310486+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:22.085+00:00","detail_url":"/advisories/advisory%3Aafa4a461-afe0-41f1-bcf5-871dc7234e35","group":{"id":"advisory:afa4a461-afe0-41f1-bcf5-871dc7234e35","revision":1,"primary_event_id":84025,"change":"published","superseded_by":[],"changed":{"id":84025,"cve_ids":["CVE-2026-102578"],"payload":{"kind":"advisory","title":"Moodle: sql injection in question bank web service","summary":"A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL (Structured Query Language) injection vulnerability. This issue could allow an attacker to view, alter, or delete sensitive data stored in the underlying database.","evidence":"osv:BIT-moodle-2026-102578","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"BIT-moodle-2026-102578","aliases":["BIT-moodle-2026-102578","CVE-2026-102578"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.13"},{"introduced":"5.0.0"},{"fixed":"5.0.9"},{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102578.json"}}],"modified":"2026-10-05T14:30:05.475104106Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102578","https://bugzilla.redhat.com/show_bug.cgi?id=2543632","https://moodle.org/mod/forum/discuss.php?d=482496","https://nvd.nist.gov/vuln/detail/CVE-2026-102578"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"High"}},"related_cves":[{"value":"CVE-2026-102578","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:afa4a461-afe0-41f1-bcf5-871dc7234e35","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102578","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"products":[],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102578","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102578","advisory_id":"afa4a461-afe0-41f1-bcf5-871dc7234e35","event_types":["advisory"],"published_at":"2026-10-26T22:36:16.310486+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:22.085+00:00","detail_url":"/events/84025"},"members":[{"id":84025,"cve_ids":["CVE-2026-102578"],"payload":{"kind":"advisory","title":"Moodle: sql injection in question bank web service","summary":"A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL (Structured Query Language) injection vulnerability. This issue could allow an attacker to view, alter, or delete sensitive data stored in the underlying database.","evidence":"osv:BIT-moodle-2026-102578","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"BIT-moodle-2026-102578","aliases":["BIT-moodle-2026-102578","CVE-2026-102578"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.13"},{"introduced":"5.0.0"},{"fixed":"5.0.9"},{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102578.json"}}],"modified":"2026-10-05T14:30:05.475104106Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102578","https://bugzilla.redhat.com/show_bug.cgi?id=2543632","https://moodle.org/mod/forum/discuss.php?d=482496","https://nvd.nist.gov/vuln/detail/CVE-2026-102578"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"High"}},"related_cves":[{"value":"CVE-2026-102578","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:afa4a461-afe0-41f1-bcf5-871dc7234e35","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102578","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"products":[],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102578","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102578","advisory_id":"afa4a461-afe0-41f1-bcf5-871dc7234e35","event_types":["advisory"],"published_at":"2026-10-26T22:36:16.310486+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:22.085+00:00","detail_url":"/events/84025"}]}},{"id":76299,"cve_ids":["CVE-2026-102582"],"payload":{"kind":"advisory","title":"Moodle: manual enrolment page accessible when plugin disabled","summary":"A flaw was found in Moodle. The manual enrolment management page did not properly check whether the manual enrolment plugin was disabled, allowing users with enrolment permissions to access the page directly by navigating to its URL. Consequently, an authorized user could manage manual enrolments even after an administrator disabled the feature in the user interface.","evidence":"osv:BIT-moodle-2026-102582","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-moodle-2026-102582","aliases":["BIT-moodle-2026-102582","CVE-2026-102582"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.13"},{"introduced":"5.0.0"},{"fixed":"5.0.9"},{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102582.json"}}],"modified":"2026-10-05T14:30:05.472451420Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102582","https://bugzilla.redhat.com/show_bug.cgi?id=2543636","https://moodle.org/mod/forum/discuss.php?d=482500","https://nvd.nist.gov/vuln/detail/CVE-2026-102582"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-102582","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:0a84a6f3-90a9-41a6-abee-3fdf58a0b6f7","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102582","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Low","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.2,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"products":[],"severity":"low","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102582","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102582","advisory_id":"0a84a6f3-90a9-41a6-abee-3fdf58a0b6f7","event_types":["advisory"],"published_at":"2026-10-26T22:36:14.998234+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:27.334+00:00","detail_url":"/advisories/advisory%3A0a84a6f3-90a9-41a6-abee-3fdf58a0b6f7","group":{"id":"advisory:0a84a6f3-90a9-41a6-abee-3fdf58a0b6f7","revision":1,"primary_event_id":84022,"change":"published","superseded_by":[],"changed":{"id":84022,"cve_ids":["CVE-2026-102582"],"payload":{"kind":"advisory","title":"Moodle: manual enrolment page accessible when plugin disabled","summary":"A flaw was found in Moodle. The manual enrolment management page did not properly check whether the manual enrolment plugin was disabled, allowing users with enrolment permissions to access the page directly by navigating to its URL. Consequently, an authorized user could manage manual enrolments even after an administrator disabled the feature in the user interface.","evidence":"osv:BIT-moodle-2026-102582","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-moodle-2026-102582","aliases":["BIT-moodle-2026-102582","CVE-2026-102582"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.13"},{"introduced":"5.0.0"},{"fixed":"5.0.9"},{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102582.json"}}],"modified":"2026-10-05T14:30:05.472451420Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102582","https://bugzilla.redhat.com/show_bug.cgi?id=2543636","https://moodle.org/mod/forum/discuss.php?d=482500","https://nvd.nist.gov/vuln/detail/CVE-2026-102582"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-102582","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:0a84a6f3-90a9-41a6-abee-3fdf58a0b6f7","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102582","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Low","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.2,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"products":[],"severity":"low","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102582","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102582","advisory_id":"0a84a6f3-90a9-41a6-abee-3fdf58a0b6f7","event_types":["advisory"],"published_at":"2026-10-26T22:36:14.998234+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:27.334+00:00","detail_url":"/events/84022"},"members":[{"id":84022,"cve_ids":["CVE-2026-102582"],"payload":{"kind":"advisory","title":"Moodle: manual enrolment page accessible when plugin disabled","summary":"A flaw was found in Moodle. The manual enrolment management page did not properly check whether the manual enrolment plugin was disabled, allowing users with enrolment permissions to access the page directly by navigating to its URL. Consequently, an authorized user could manage manual enrolments even after an administrator disabled the feature in the user interface.","evidence":"osv:BIT-moodle-2026-102582","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-moodle-2026-102582","aliases":["BIT-moodle-2026-102582","CVE-2026-102582"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.13"},{"introduced":"5.0.0"},{"fixed":"5.0.9"},{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102582.json"}}],"modified":"2026-10-05T14:30:05.472451420Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102582","https://bugzilla.redhat.com/show_bug.cgi?id=2543636","https://moodle.org/mod/forum/discuss.php?d=482500","https://nvd.nist.gov/vuln/detail/CVE-2026-102582"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-102582","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:0a84a6f3-90a9-41a6-abee-3fdf58a0b6f7","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102582","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Low","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.2,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"products":[],"severity":"low","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102582","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102582","advisory_id":"0a84a6f3-90a9-41a6-abee-3fdf58a0b6f7","event_types":["advisory"],"published_at":"2026-10-26T22:36:14.998234+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:27.334+00:00","detail_url":"/events/84022"}]}},{"id":76295,"cve_ids":["CVE-2026-102588"],"payload":{"kind":"advisory","title":"Moodle: csrf in xml grade import","summary":"A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthorized requests on the victim's behalf. This flaw allows a remote attacker to set or overwrite student grades without authorization.","evidence":"osv:BIT-moodle-2026-102588","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-moodle-2026-102588","aliases":["BIT-moodle-2026-102588","CVE-2026-102588"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.13"},{"introduced":"5.0.0"},{"fixed":"5.0.9"},{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102588.json"}}],"modified":"2026-10-05T14:30:04.548020576Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102588","https://bugzilla.redhat.com/show_bug.cgi?id=2543643","https://moodle.org/mod/forum/discuss.php?d=482507","https://nvd.nist.gov/vuln/detail/CVE-2026-102588"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-102588","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:b3dce588-7345-47a9-9e64-b610ee194eab","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102588","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102588","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102588","advisory_id":"b3dce588-7345-47a9-9e64-b610ee194eab","event_types":["advisory"],"published_at":"2026-10-26T22:36:11.695768+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:35.76+00:00","detail_url":"/advisories/advisory%3Ab3dce588-7345-47a9-9e64-b610ee194eab","group":{"id":"advisory:b3dce588-7345-47a9-9e64-b610ee194eab","revision":1,"primary_event_id":84005,"change":"published","superseded_by":[],"changed":{"id":84005,"cve_ids":["CVE-2026-102588"],"payload":{"kind":"advisory","title":"Moodle: csrf in xml grade import","summary":"A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthorized requests on the victim's behalf. This flaw allows a remote attacker to set or overwrite student grades without authorization.","evidence":"osv:BIT-moodle-2026-102588","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-moodle-2026-102588","aliases":["BIT-moodle-2026-102588","CVE-2026-102588"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.13"},{"introduced":"5.0.0"},{"fixed":"5.0.9"},{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102588.json"}}],"modified":"2026-10-05T14:30:04.548020576Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102588","https://bugzilla.redhat.com/show_bug.cgi?id=2543643","https://moodle.org/mod/forum/discuss.php?d=482507","https://nvd.nist.gov/vuln/detail/CVE-2026-102588"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-102588","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:b3dce588-7345-47a9-9e64-b610ee194eab","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102588","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102588","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102588","advisory_id":"b3dce588-7345-47a9-9e64-b610ee194eab","event_types":["advisory"],"published_at":"2026-10-26T22:36:11.695768+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:35.76+00:00","detail_url":"/events/84005"},"members":[{"id":84005,"cve_ids":["CVE-2026-102588"],"payload":{"kind":"advisory","title":"Moodle: csrf in xml grade import","summary":"A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthorized requests on the victim's behalf. This flaw allows a remote attacker to set or overwrite student grades without authorization.","evidence":"osv:BIT-moodle-2026-102588","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-moodle-2026-102588","aliases":["BIT-moodle-2026-102588","CVE-2026-102588"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.13"},{"introduced":"5.0.0"},{"fixed":"5.0.9"},{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102588.json"}}],"modified":"2026-10-05T14:30:04.548020576Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102588","https://bugzilla.redhat.com/show_bug.cgi?id=2543643","https://moodle.org/mod/forum/discuss.php?d=482507","https://nvd.nist.gov/vuln/detail/CVE-2026-102588"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-102588","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:b3dce588-7345-47a9-9e64-b610ee194eab","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102588","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102588","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102588","advisory_id":"b3dce588-7345-47a9-9e64-b610ee194eab","event_types":["advisory"],"published_at":"2026-10-26T22:36:11.695768+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:35.76+00:00","detail_url":"/events/84005"}]}},{"id":76293,"cve_ids":["CVE-2026-102587"],"payload":{"kind":"advisory","title":"Moodle: user list filters bypass profile field visibility","summary":"A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure by inferring hidden user data.","evidence":"osv:BIT-moodle-2026-102587","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"low","structured":{"id":"BIT-moodle-2026-102587","aliases":["BIT-moodle-2026-102587","CVE-2026-102587"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.13"},{"introduced":"5.0.0"},{"fixed":"5.0.9"},{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102587.json"}}],"modified":"2026-10-05T14:30:04.546375678Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102587","https://bugzilla.redhat.com/show_bug.cgi?id=2543642","https://moodle.org/mod/forum/discuss.php?d=482506","https://nvd.nist.gov/vuln/detail/CVE-2026-102587"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"Low"}},"related_cves":[{"value":"CVE-2026-102587","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:858e2eb9-e2b1-4f10-b49b-9443c3094dbe","priority":{"reasons":[],"severity":"low","linked_cves":[{"cve":"CVE-2026-102587","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Low","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.7,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}}],"products":[],"severity":"low","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102587","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102587","advisory_id":"858e2eb9-e2b1-4f10-b49b-9443c3094dbe","event_types":["advisory"],"published_at":"2026-10-26T22:36:09.65412+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:34.249+00:00","detail_url":"/advisories/advisory%3A858e2eb9-e2b1-4f10-b49b-9443c3094dbe","group":{"id":"advisory:858e2eb9-e2b1-4f10-b49b-9443c3094dbe","revision":1,"primary_event_id":83997,"change":"published","superseded_by":[],"changed":{"id":83997,"cve_ids":["CVE-2026-102587"],"payload":{"kind":"advisory","title":"Moodle: user list filters bypass profile field visibility","summary":"A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure by inferring hidden user data.","evidence":"osv:BIT-moodle-2026-102587","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"low","structured":{"id":"BIT-moodle-2026-102587","aliases":["BIT-moodle-2026-102587","CVE-2026-102587"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.13"},{"introduced":"5.0.0"},{"fixed":"5.0.9"},{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102587.json"}}],"modified":"2026-10-05T14:30:04.546375678Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102587","https://bugzilla.redhat.com/show_bug.cgi?id=2543642","https://moodle.org/mod/forum/discuss.php?d=482506","https://nvd.nist.gov/vuln/detail/CVE-2026-102587"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"Low"}},"related_cves":[{"value":"CVE-2026-102587","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:858e2eb9-e2b1-4f10-b49b-9443c3094dbe","priority":{"reasons":[],"severity":"low","linked_cves":[{"cve":"CVE-2026-102587","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Low","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.7,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}}],"products":[],"severity":"low","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102587","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102587","advisory_id":"858e2eb9-e2b1-4f10-b49b-9443c3094dbe","event_types":["advisory"],"published_at":"2026-10-26T22:36:09.65412+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:34.249+00:00","detail_url":"/events/83997"},"members":[{"id":83997,"cve_ids":["CVE-2026-102587"],"payload":{"kind":"advisory","title":"Moodle: user list filters bypass profile field visibility","summary":"A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure by inferring hidden user data.","evidence":"osv:BIT-moodle-2026-102587","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"low","structured":{"id":"BIT-moodle-2026-102587","aliases":["BIT-moodle-2026-102587","CVE-2026-102587"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.13"},{"introduced":"5.0.0"},{"fixed":"5.0.9"},{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102587.json"}}],"modified":"2026-10-05T14:30:04.546375678Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102587","https://bugzilla.redhat.com/show_bug.cgi?id=2543642","https://moodle.org/mod/forum/discuss.php?d=482506","https://nvd.nist.gov/vuln/detail/CVE-2026-102587"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"Low"}},"related_cves":[{"value":"CVE-2026-102587","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:858e2eb9-e2b1-4f10-b49b-9443c3094dbe","priority":{"reasons":[],"severity":"low","linked_cves":[{"cve":"CVE-2026-102587","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Low","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.7,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}}],"products":[],"severity":"low","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102587","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102587","advisory_id":"858e2eb9-e2b1-4f10-b49b-9443c3094dbe","event_types":["advisory"],"published_at":"2026-10-26T22:36:09.65412+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:34.249+00:00","detail_url":"/events/83997"}]}},{"id":76278,"cve_ids":["CVE-2026-102583"],"payload":{"kind":"advisory","title":"Moodle: incorrect capability check in ai generate image web service","summary":"A flaw was found in Moodle. An incorrect capability check in the artificial intelligence (AI) editor placement's image generation web service allows an authenticated user to invoke the feature without holding the required capability. This flaw permits unauthorized users to access and utilize the AI image generation functionality.","evidence":"osv:BIT-moodle-2026-102583","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"low","structured":{"id":"BIT-moodle-2026-102583","aliases":["BIT-moodle-2026-102583","CVE-2026-102583"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.13"},{"introduced":"5.0.0"},{"fixed":"5.0.9"},{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102583.json"}}],"modified":"2026-10-05T14:30:04.535212727Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102583","https://bugzilla.redhat.com/show_bug.cgi?id=2543640","https://moodle.org/mod/forum/discuss.php?d=482501","https://nvd.nist.gov/vuln/detail/CVE-2026-102583"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"Low"}},"related_cves":[{"value":"CVE-2026-102583","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:683c891b-c6f7-4b4f-b585-88d97406f9e6","priority":{"reasons":[],"severity":"low","linked_cves":[{"cve":"CVE-2026-102583","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Low","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.7,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"products":[],"severity":"low","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102583","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102583","advisory_id":"683c891b-c6f7-4b4f-b585-88d97406f9e6","event_types":["advisory"],"published_at":"2026-10-26T22:36:03.281681+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:28.669+00:00","detail_url":"/advisories/advisory%3A683c891b-c6f7-4b4f-b585-88d97406f9e6","group":{"id":"advisory:683c891b-c6f7-4b4f-b585-88d97406f9e6","revision":1,"primary_event_id":83967,"change":"published","superseded_by":[],"changed":{"id":83967,"cve_ids":["CVE-2026-102583"],"payload":{"kind":"advisory","title":"Moodle: incorrect capability check in ai generate image web service","summary":"A flaw was found in Moodle. An incorrect capability check in the artificial intelligence (AI) editor placement's image generation web service allows an authenticated user to invoke the feature without holding the required capability. This flaw permits unauthorized users to access and utilize the AI image generation functionality.","evidence":"osv:BIT-moodle-2026-102583","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"low","structured":{"id":"BIT-moodle-2026-102583","aliases":["BIT-moodle-2026-102583","CVE-2026-102583"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.13"},{"introduced":"5.0.0"},{"fixed":"5.0.9"},{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102583.json"}}],"modified":"2026-10-05T14:30:04.535212727Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102583","https://bugzilla.redhat.com/show_bug.cgi?id=2543640","https://moodle.org/mod/forum/discuss.php?d=482501","https://nvd.nist.gov/vuln/detail/CVE-2026-102583"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"Low"}},"related_cves":[{"value":"CVE-2026-102583","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:683c891b-c6f7-4b4f-b585-88d97406f9e6","priority":{"reasons":[],"severity":"low","linked_cves":[{"cve":"CVE-2026-102583","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Low","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.7,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"products":[],"severity":"low","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102583","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102583","advisory_id":"683c891b-c6f7-4b4f-b585-88d97406f9e6","event_types":["advisory"],"published_at":"2026-10-26T22:36:03.281681+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:28.669+00:00","detail_url":"/events/83967"},"members":[{"id":83967,"cve_ids":["CVE-2026-102583"],"payload":{"kind":"advisory","title":"Moodle: incorrect capability check in ai generate image web service","summary":"A flaw was found in Moodle. An incorrect capability check in the artificial intelligence (AI) editor placement's image generation web service allows an authenticated user to invoke the feature without holding the required capability. This flaw permits unauthorized users to access and utilize the AI image generation functionality.","evidence":"osv:BIT-moodle-2026-102583","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"low","structured":{"id":"BIT-moodle-2026-102583","aliases":["BIT-moodle-2026-102583","CVE-2026-102583"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.13"},{"introduced":"5.0.0"},{"fixed":"5.0.9"},{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.2"}]}],"package":{"name":"moodle","purl":"pkg:bitnami/moodle","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102583.json"}}],"modified":"2026-10-05T14:30:04.535212727Z","provider":"osv","references":["https://access.redhat.com/security/cve/CVE-2026-102583","https://bugzilla.redhat.com/show_bug.cgi?id=2543640","https://moodle.org/mod/forum/discuss.php?d=482501","https://nvd.nist.gov/vuln/detail/CVE-2026-102583"],"provider_metadata":{"cpes":["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"],"severity":"Low"}},"related_cves":[{"value":"CVE-2026-102583","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:683c891b-c6f7-4b4f-b585-88d97406f9e6","priority":{"reasons":[],"severity":"low","linked_cves":[{"cve":"CVE-2026-102583","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Low","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.7,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"products":[],"severity":"low","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102583","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102583","advisory_id":"683c891b-c6f7-4b4f-b585-88d97406f9e6","event_types":["advisory"],"published_at":"2026-10-26T22:36:03.281681+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T11:55:28.669+00:00","detail_url":"/events/83967"}]}},{"id":70987,"cve_ids":["CVE-2026-102580"],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102580","summary":"A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected application behavior.","evidence":"osv:UBUNTU-CVE-2026-102580","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"medium","structured":{"id":"UBUNTU-CVE-2026-102580","aliases":["UBUNTU-CVE-2026-102580"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102580.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102580.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-02T22:30:12.352185688Z","provider":"osv","upstream":["CVE-2026-102580"],"references":["https://ubuntu.com/security/CVE-2026-102580","https://www.cve.org/CVERecord?id=CVE-2026-102580","https://access.redhat.com/security/cve/CVE-2026-102580","https://bugzilla.redhat.com/show_bug.cgi?id=2543635","https://moodle.org/mod/forum/discuss.php?d=482498"]},"related_cves":[{"value":"CVE-2026-102580","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/1/score"},"group_id":"advisory:72dd35cb-b501-4534-9abc-87fca8602800","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102580","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Low","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.2,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"products":[],"severity":"low","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102580","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102580","metrics":[],"products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102580","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102580","advisory_id":"72dd35cb-b501-4534-9abc-87fca8602800","event_types":["advisory"],"published_at":"2026-10-25T22:46:10.098836+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/advisories/advisory%3A72dd35cb-b501-4534-9abc-87fca8602800","group":{"id":"advisory:72dd35cb-b501-4534-9abc-87fca8602800","revision":1,"primary_event_id":84154,"change":"published","superseded_by":[],"changed":{"id":71360,"cve_ids":["CVE-2026-102580"],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102580","summary":"A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected application behavior.","evidence":"osv:UBUNTU-CVE-2026-102580","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"medium","structured":{"id":"UBUNTU-CVE-2026-102580","aliases":["UBUNTU-CVE-2026-102580"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102580.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102580.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-02T22:30:12.352185688Z","provider":"osv","upstream":["CVE-2026-102580"],"references":["https://ubuntu.com/security/CVE-2026-102580","https://www.cve.org/CVERecord?id=CVE-2026-102580","https://access.redhat.com/security/cve/CVE-2026-102580","https://bugzilla.redhat.com/show_bug.cgi?id=2543635","https://moodle.org/mod/forum/discuss.php?d=482498"]},"related_cves":[{"value":"CVE-2026-102580","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/1/score"},"group_id":"advisory:72dd35cb-b501-4534-9abc-87fca8602800","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102580","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Low","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.2,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"products":[],"severity":"low","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102580","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102580","advisory_id":"72dd35cb-b501-4534-9abc-87fca8602800","event_types":["advisory"],"published_at":"2026-10-25T22:46:10.098836+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/events/71360"},"members":[{"id":84154,"cve_ids":["CVE-2026-102580"],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102580","summary":"A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected application behavior.","evidence":"osv:UBUNTU-CVE-2026-102580","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"medium","structured":{"id":"UBUNTU-CVE-2026-102580","aliases":["UBUNTU-CVE-2026-102580"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102580.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102580.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-02T22:30:12.352185688Z","provider":"osv","upstream":["CVE-2026-102580"],"references":["https://ubuntu.com/security/CVE-2026-102580","https://www.cve.org/CVERecord?id=CVE-2026-102580","https://access.redhat.com/security/cve/CVE-2026-102580","https://bugzilla.redhat.com/show_bug.cgi?id=2543635","https://moodle.org/mod/forum/discuss.php?d=482498"]},"related_cves":[{"value":"CVE-2026-102580","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/1/score"},"group_id":"advisory:72dd35cb-b501-4534-9abc-87fca8602800","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102580","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Low","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.2,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"products":[],"severity":"low","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102580","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102580","metrics":[],"products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102580","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102580","advisory_id":"72dd35cb-b501-4534-9abc-87fca8602800","event_types":["advisory"],"published_at":"2026-10-26T22:37:21.468139+00:00","technologies":["core-osv","moodle"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/events/84154"}]}},{"id":70986,"cve_ids":["CVE-2026-102586"],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102586","summary":"A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting (XSS) attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary script in the victim's browser.","evidence":"osv:UBUNTU-CVE-2026-102586","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"medium","structured":{"id":"UBUNTU-CVE-2026-102586","aliases":["UBUNTU-CVE-2026-102586"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102586.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102586.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-02T22:30:11.012195642Z","provider":"osv","upstream":["CVE-2026-102586"],"references":["https://ubuntu.com/security/CVE-2026-102586","https://www.cve.org/CVERecord?id=CVE-2026-102586","https://access.redhat.com/security/cve/CVE-2026-102586","https://bugzilla.redhat.com/show_bug.cgi?id=2543641","https://moodle.org/mod/forum/discuss.php?d=482504"]},"related_cves":[{"value":"CVE-2026-102586","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/1/score"},"group_id":"advisory:b76ffac4-5269-49d9-b49e-2bc8d3b516e4","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102586","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"products":[],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102586","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102586","metrics":[],"products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102586","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102586","advisory_id":"b76ffac4-5269-49d9-b49e-2bc8d3b516e4","event_types":["advisory"],"published_at":"2026-10-25T22:46:09.288424+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/advisories/advisory%3Ab76ffac4-5269-49d9-b49e-2bc8d3b516e4","group":{"id":"advisory:b76ffac4-5269-49d9-b49e-2bc8d3b516e4","revision":1,"primary_event_id":84164,"change":"published","superseded_by":[],"changed":{"id":71359,"cve_ids":["CVE-2026-102586"],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102586","summary":"A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting (XSS) attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary script in the victim's browser.","evidence":"osv:UBUNTU-CVE-2026-102586","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"medium","structured":{"id":"UBUNTU-CVE-2026-102586","aliases":["UBUNTU-CVE-2026-102586"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102586.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102586.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-02T22:30:11.012195642Z","provider":"osv","upstream":["CVE-2026-102586"],"references":["https://ubuntu.com/security/CVE-2026-102586","https://www.cve.org/CVERecord?id=CVE-2026-102586","https://access.redhat.com/security/cve/CVE-2026-102586","https://bugzilla.redhat.com/show_bug.cgi?id=2543641","https://moodle.org/mod/forum/discuss.php?d=482504"]},"related_cves":[{"value":"CVE-2026-102586","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/1/score"},"group_id":"advisory:b76ffac4-5269-49d9-b49e-2bc8d3b516e4","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102586","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"products":[],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102586","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102586","advisory_id":"b76ffac4-5269-49d9-b49e-2bc8d3b516e4","event_types":["advisory"],"published_at":"2026-10-25T22:46:09.288424+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/events/71359"},"members":[{"id":84164,"cve_ids":["CVE-2026-102586"],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102586","summary":"A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting (XSS) attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary script in the victim's browser.","evidence":"osv:UBUNTU-CVE-2026-102586","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"medium","structured":{"id":"UBUNTU-CVE-2026-102586","aliases":["UBUNTU-CVE-2026-102586"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102586.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102586.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-02T22:30:11.012195642Z","provider":"osv","upstream":["CVE-2026-102586"],"references":["https://ubuntu.com/security/CVE-2026-102586","https://www.cve.org/CVERecord?id=CVE-2026-102586","https://access.redhat.com/security/cve/CVE-2026-102586","https://bugzilla.redhat.com/show_bug.cgi?id=2543641","https://moodle.org/mod/forum/discuss.php?d=482504"]},"related_cves":[{"value":"CVE-2026-102586","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/1/score"},"group_id":"advisory:b76ffac4-5269-49d9-b49e-2bc8d3b516e4","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102586","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"products":[],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102586","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102586","metrics":[],"products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102586","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102586","advisory_id":"b76ffac4-5269-49d9-b49e-2bc8d3b516e4","event_types":["advisory"],"published_at":"2026-10-26T22:37:26.773957+00:00","technologies":["core-osv","moodle"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/events/84164"}]}},{"id":70985,"cve_ids":["CVE-2026-102581"],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102581","summary":"A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting (XSS) vulnerability. An attacker can inject malicious content into a forum post, which then executes arbitrary script code in the browser of another user viewing the affected post.","evidence":"osv:UBUNTU-CVE-2026-102581","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"medium","structured":{"id":"UBUNTU-CVE-2026-102581","aliases":["UBUNTU-CVE-2026-102581"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102581.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102581.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-02T22:30:12.053090161Z","provider":"osv","upstream":["CVE-2026-102581"],"references":["https://ubuntu.com/security/CVE-2026-102581","https://www.cve.org/CVERecord?id=CVE-2026-102581","https://access.redhat.com/security/cve/CVE-2026-102581","https://bugzilla.redhat.com/show_bug.cgi?id=2543634","https://moodle.org/mod/forum/discuss.php?d=482499"]},"related_cves":[{"value":"CVE-2026-102581","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/1/score"},"group_id":"advisory:3c3028db-d5de-4529-85f4-268f3643a4f0","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102581","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.6,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"products":[],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102581","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102581","metrics":[],"products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102581","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102581","advisory_id":"3c3028db-d5de-4529-85f4-268f3643a4f0","event_types":["advisory"],"published_at":"2026-10-25T22:46:08.347322+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/advisories/advisory%3A3c3028db-d5de-4529-85f4-268f3643a4f0","group":{"id":"advisory:3c3028db-d5de-4529-85f4-268f3643a4f0","revision":1,"primary_event_id":84118,"change":"published","superseded_by":[],"changed":{"id":71358,"cve_ids":["CVE-2026-102581"],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102581","summary":"A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting (XSS) vulnerability. An attacker can inject malicious content into a forum post, which then executes arbitrary script code in the browser of another user viewing the affected post.","evidence":"osv:UBUNTU-CVE-2026-102581","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"medium","structured":{"id":"UBUNTU-CVE-2026-102581","aliases":["UBUNTU-CVE-2026-102581"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102581.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102581.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-02T22:30:12.053090161Z","provider":"osv","upstream":["CVE-2026-102581"],"references":["https://ubuntu.com/security/CVE-2026-102581","https://www.cve.org/CVERecord?id=CVE-2026-102581","https://access.redhat.com/security/cve/CVE-2026-102581","https://bugzilla.redhat.com/show_bug.cgi?id=2543634","https://moodle.org/mod/forum/discuss.php?d=482499"]},"related_cves":[{"value":"CVE-2026-102581","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/1/score"},"group_id":"advisory:3c3028db-d5de-4529-85f4-268f3643a4f0","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102581","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.6,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"products":[],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102581","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102581","advisory_id":"3c3028db-d5de-4529-85f4-268f3643a4f0","event_types":["advisory"],"published_at":"2026-10-25T22:46:08.347322+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/events/71358"},"members":[{"id":84118,"cve_ids":["CVE-2026-102581"],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102581","summary":"A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting (XSS) vulnerability. An attacker can inject malicious content into a forum post, which then executes arbitrary script code in the browser of another user viewing the affected post.","evidence":"osv:UBUNTU-CVE-2026-102581","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"medium","structured":{"id":"UBUNTU-CVE-2026-102581","aliases":["UBUNTU-CVE-2026-102581"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102581.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102581.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-02T22:30:12.053090161Z","provider":"osv","upstream":["CVE-2026-102581"],"references":["https://ubuntu.com/security/CVE-2026-102581","https://www.cve.org/CVERecord?id=CVE-2026-102581","https://access.redhat.com/security/cve/CVE-2026-102581","https://bugzilla.redhat.com/show_bug.cgi?id=2543634","https://moodle.org/mod/forum/discuss.php?d=482499"]},"related_cves":[{"value":"CVE-2026-102581","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/1/score"},"group_id":"advisory:3c3028db-d5de-4529-85f4-268f3643a4f0","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102581","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.6,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"products":[],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102581","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102581","metrics":[],"products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102581","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102581","advisory_id":"3c3028db-d5de-4529-85f4-268f3643a4f0","event_types":["advisory"],"published_at":"2026-10-26T22:36:27.924725+00:00","technologies":["core-osv","moodle"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/events/84118"}]}},{"id":70984,"cve_ids":["CVE-2026-102578"],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102578","summary":"A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL (Structured Query Language) injection vulnerability. This issue could allow an attacker to view, alter, or delete sensitive data stored in the underlying database.","evidence":"osv:UBUNTU-CVE-2026-102578","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"high","structured":{"id":"UBUNTU-CVE-2026-102578","aliases":["UBUNTU-CVE-2026-102578"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102578.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102578.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-02T22:30:09.411466015Z","provider":"osv","upstream":["CVE-2026-102578"],"references":["https://ubuntu.com/security/CVE-2026-102578","https://www.cve.org/CVERecord?id=CVE-2026-102578","https://access.redhat.com/security/cve/CVE-2026-102578","https://bugzilla.redhat.com/show_bug.cgi?id=2543632","https://moodle.org/mod/forum/discuss.php?d=482496"]},"related_cves":[{"value":"CVE-2026-102578","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/1/score"},"group_id":"advisory:f5c083cc-a9cc-4079-ad07-b6fcc6b9c221","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102578","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"products":[],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102578","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102578","metrics":[],"products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102578","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102578","advisory_id":"f5c083cc-a9cc-4079-ad07-b6fcc6b9c221","event_types":["advisory"],"published_at":"2026-10-25T22:46:07.585571+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/advisories/advisory%3Af5c083cc-a9cc-4079-ad07-b6fcc6b9c221","group":{"id":"advisory:f5c083cc-a9cc-4079-ad07-b6fcc6b9c221","revision":1,"primary_event_id":84027,"change":"published","superseded_by":[],"changed":{"id":71357,"cve_ids":["CVE-2026-102578"],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102578","summary":"A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL (Structured Query Language) injection vulnerability. This issue could allow an attacker to view, alter, or delete sensitive data stored in the underlying database.","evidence":"osv:UBUNTU-CVE-2026-102578","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"high","structured":{"id":"UBUNTU-CVE-2026-102578","aliases":["UBUNTU-CVE-2026-102578"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102578.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102578.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-02T22:30:09.411466015Z","provider":"osv","upstream":["CVE-2026-102578"],"references":["https://ubuntu.com/security/CVE-2026-102578","https://www.cve.org/CVERecord?id=CVE-2026-102578","https://access.redhat.com/security/cve/CVE-2026-102578","https://bugzilla.redhat.com/show_bug.cgi?id=2543632","https://moodle.org/mod/forum/discuss.php?d=482496"]},"related_cves":[{"value":"CVE-2026-102578","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/1/score"},"group_id":"advisory:f5c083cc-a9cc-4079-ad07-b6fcc6b9c221","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102578","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"products":[],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102578","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102578","advisory_id":"f5c083cc-a9cc-4079-ad07-b6fcc6b9c221","event_types":["advisory"],"published_at":"2026-10-25T22:46:07.585571+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/events/71357"},"members":[{"id":84027,"cve_ids":["CVE-2026-102578"],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102578","summary":"A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL (Structured Query Language) injection vulnerability. This issue could allow an attacker to view, alter, or delete sensitive data stored in the underlying database.","evidence":"osv:UBUNTU-CVE-2026-102578","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"high","structured":{"id":"UBUNTU-CVE-2026-102578","aliases":["UBUNTU-CVE-2026-102578"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102578.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102578.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-02T22:30:09.411466015Z","provider":"osv","upstream":["CVE-2026-102578"],"references":["https://ubuntu.com/security/CVE-2026-102578","https://www.cve.org/CVERecord?id=CVE-2026-102578","https://access.redhat.com/security/cve/CVE-2026-102578","https://bugzilla.redhat.com/show_bug.cgi?id=2543632","https://moodle.org/mod/forum/discuss.php?d=482496"]},"related_cves":[{"value":"CVE-2026-102578","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/1/score"},"group_id":"advisory:f5c083cc-a9cc-4079-ad07-b6fcc6b9c221","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102578","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"products":[],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102578","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102578","metrics":[],"products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102578","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102578","advisory_id":"f5c083cc-a9cc-4079-ad07-b6fcc6b9c221","event_types":["advisory"],"published_at":"2026-10-26T22:36:16.310486+00:00","technologies":["core-osv","moodle"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/events/84027"}]}},{"id":70983,"cve_ids":["CVE-2026-102582"],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102582","summary":"A flaw was found in Moodle. The manual enrolment management page did not properly check whether the manual enrolment plugin was disabled, allowing users with enrolment permissions to access the page directly by navigating to its URL. Consequently, an authorized user could manage manual enrolments even after an administrator disabled the feature in the user interface.","evidence":"osv:UBUNTU-CVE-2026-102582","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"medium","structured":{"id":"UBUNTU-CVE-2026-102582","aliases":["UBUNTU-CVE-2026-102582"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102582.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102582.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-02T22:30:10.345751453Z","provider":"osv","upstream":["CVE-2026-102582"],"references":["https://ubuntu.com/security/CVE-2026-102582","https://www.cve.org/CVERecord?id=CVE-2026-102582","https://access.redhat.com/security/cve/CVE-2026-102582","https://bugzilla.redhat.com/show_bug.cgi?id=2543636","https://moodle.org/mod/forum/discuss.php?d=482500"]},"related_cves":[{"value":"CVE-2026-102582","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/1/score"},"group_id":"advisory:b7f3e59a-00f7-452c-b133-d499f56dea36","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102582","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Low","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.2,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"products":[],"severity":"low","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102582","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102582","metrics":[],"products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102582","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102582","advisory_id":"b7f3e59a-00f7-452c-b133-d499f56dea36","event_types":["advisory"],"published_at":"2026-10-25T22:46:06.722666+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/advisories/advisory%3Ab7f3e59a-00f7-452c-b133-d499f56dea36","group":{"id":"advisory:b7f3e59a-00f7-452c-b133-d499f56dea36","revision":1,"primary_event_id":84024,"change":"published","superseded_by":[],"changed":{"id":71356,"cve_ids":["CVE-2026-102582"],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102582","summary":"A flaw was found in Moodle. The manual enrolment management page did not properly check whether the manual enrolment plugin was disabled, allowing users with enrolment permissions to access the page directly by navigating to its URL. Consequently, an authorized user could manage manual enrolments even after an administrator disabled the feature in the user interface.","evidence":"osv:UBUNTU-CVE-2026-102582","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"medium","structured":{"id":"UBUNTU-CVE-2026-102582","aliases":["UBUNTU-CVE-2026-102582"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102582.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102582.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-02T22:30:10.345751453Z","provider":"osv","upstream":["CVE-2026-102582"],"references":["https://ubuntu.com/security/CVE-2026-102582","https://www.cve.org/CVERecord?id=CVE-2026-102582","https://access.redhat.com/security/cve/CVE-2026-102582","https://bugzilla.redhat.com/show_bug.cgi?id=2543636","https://moodle.org/mod/forum/discuss.php?d=482500"]},"related_cves":[{"value":"CVE-2026-102582","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/1/score"},"group_id":"advisory:b7f3e59a-00f7-452c-b133-d499f56dea36","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102582","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Low","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.2,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"products":[],"severity":"low","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102582","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102582","advisory_id":"b7f3e59a-00f7-452c-b133-d499f56dea36","event_types":["advisory"],"published_at":"2026-10-25T22:46:06.722666+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/events/71356"},"members":[{"id":84024,"cve_ids":["CVE-2026-102582"],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102582","summary":"A flaw was found in Moodle. The manual enrolment management page did not properly check whether the manual enrolment plugin was disabled, allowing users with enrolment permissions to access the page directly by navigating to its URL. Consequently, an authorized user could manage manual enrolments even after an administrator disabled the feature in the user interface.","evidence":"osv:UBUNTU-CVE-2026-102582","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"medium","structured":{"id":"UBUNTU-CVE-2026-102582","aliases":["UBUNTU-CVE-2026-102582"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102582.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102582.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-02T22:30:10.345751453Z","provider":"osv","upstream":["CVE-2026-102582"],"references":["https://ubuntu.com/security/CVE-2026-102582","https://www.cve.org/CVERecord?id=CVE-2026-102582","https://access.redhat.com/security/cve/CVE-2026-102582","https://bugzilla.redhat.com/show_bug.cgi?id=2543636","https://moodle.org/mod/forum/discuss.php?d=482500"]},"related_cves":[{"value":"CVE-2026-102582","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/1/score"},"group_id":"advisory:b7f3e59a-00f7-452c-b133-d499f56dea36","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102582","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Low","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.2,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"products":[],"severity":"low","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102582","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102582","metrics":[],"products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.13","evidence":"/affected/0/ranges"},{"value":"5.0.9","evidence":"/affected/0/ranges"},{"value":"5.1.6","evidence":"/affected/0/ranges"},{"value":"5.2.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-moodle-2026-102582","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102582","advisory_id":"b7f3e59a-00f7-452c-b133-d499f56dea36","event_types":["advisory"],"published_at":"2026-10-26T22:36:14.998234+00:00","technologies":["core-osv","moodle"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/events/84024"}]}},{"id":52415,"cve_ids":[],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102577","summary":"A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted destinations, leading to Server-Side Request Forgery (SSRF).","evidence":"osv:UBUNTU-CVE-2026-102577","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"unknown","structured":{"id":"UBUNTU-CVE-2026-102577","aliases":["UBUNTU-CVE-2026-102577"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102577.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102577.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-01T00:21:06.434999212Z","provider":"osv","references":["https://ubuntu.com/security/CVE-2026-102577","https://www.cve.org/CVERecord?id=CVE-2026-102577","https://access.redhat.com/security/cve/CVE-2026-102577","https://bugzilla.redhat.com/show_bug.cgi?id=2543604","https://moodle.org/mod/forum/discuss.php?d=482495"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:181c765b-cc38-4602-9f0c-d93dcfc30ca3","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102577","advisory_id":"181c765b-cc38-4602-9f0c-d93dcfc30ca3","event_types":["advisory"],"published_at":"2026-10-25T14:36:31.223394+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/advisories/advisory%3A181c765b-cc38-4602-9f0c-d93dcfc30ca3","group":{"id":"advisory:181c765b-cc38-4602-9f0c-d93dcfc30ca3","revision":1,"primary_event_id":51943,"change":"published","superseded_by":[],"changed":{"id":51943,"cve_ids":[],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102577","summary":"A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted destinations, leading to Server-Side Request Forgery (SSRF).","evidence":"osv:UBUNTU-CVE-2026-102577","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"unknown","structured":{"id":"UBUNTU-CVE-2026-102577","aliases":["UBUNTU-CVE-2026-102577"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102577.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102577.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-01T00:21:06.434999212Z","provider":"osv","references":["https://ubuntu.com/security/CVE-2026-102577","https://www.cve.org/CVERecord?id=CVE-2026-102577","https://access.redhat.com/security/cve/CVE-2026-102577","https://bugzilla.redhat.com/show_bug.cgi?id=2543604","https://moodle.org/mod/forum/discuss.php?d=482495"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:181c765b-cc38-4602-9f0c-d93dcfc30ca3","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102577","advisory_id":"181c765b-cc38-4602-9f0c-d93dcfc30ca3","event_types":["advisory"],"published_at":"2026-10-25T14:36:31.223394+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/events/51943"},"members":[{"id":51943,"cve_ids":[],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102577","summary":"A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted destinations, leading to Server-Side Request Forgery (SSRF).","evidence":"osv:UBUNTU-CVE-2026-102577","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"unknown","structured":{"id":"UBUNTU-CVE-2026-102577","aliases":["UBUNTU-CVE-2026-102577"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102577.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102577.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-01T00:21:06.434999212Z","provider":"osv","references":["https://ubuntu.com/security/CVE-2026-102577","https://www.cve.org/CVERecord?id=CVE-2026-102577","https://access.redhat.com/security/cve/CVE-2026-102577","https://bugzilla.redhat.com/show_bug.cgi?id=2543604","https://moodle.org/mod/forum/discuss.php?d=482495"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:181c765b-cc38-4602-9f0c-d93dcfc30ca3","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102577","advisory_id":"181c765b-cc38-4602-9f0c-d93dcfc30ca3","event_types":["advisory"],"published_at":"2026-10-25T14:36:31.223394+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/events/51943"}]}},{"id":52413,"cve_ids":[],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102579","summary":"A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course that they should not have permission to view. This issue leads to unauthorized information disclosure.","evidence":"osv:UBUNTU-CVE-2026-102579","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"unknown","structured":{"id":"UBUNTU-CVE-2026-102579","aliases":["UBUNTU-CVE-2026-102579"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102579.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102579.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-01T00:21:06.290017667Z","provider":"osv","references":["https://ubuntu.com/security/CVE-2026-102579","https://www.cve.org/CVERecord?id=CVE-2026-102579","https://access.redhat.com/security/cve/CVE-2026-102579","https://bugzilla.redhat.com/show_bug.cgi?id=2543633","https://moodle.org/mod/forum/discuss.php?d=482497"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4defc2af-8a9e-4996-b8f2-f446402515bb","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102579","advisory_id":"4defc2af-8a9e-4996-b8f2-f446402515bb","event_types":["advisory"],"published_at":"2026-10-25T14:36:29.934701+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/advisories/advisory%3A4defc2af-8a9e-4996-b8f2-f446402515bb","group":{"id":"advisory:4defc2af-8a9e-4996-b8f2-f446402515bb","revision":1,"primary_event_id":51941,"change":"published","superseded_by":[],"changed":{"id":51941,"cve_ids":[],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102579","summary":"A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course that they should not have permission to view. This issue leads to unauthorized information disclosure.","evidence":"osv:UBUNTU-CVE-2026-102579","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"unknown","structured":{"id":"UBUNTU-CVE-2026-102579","aliases":["UBUNTU-CVE-2026-102579"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102579.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102579.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-01T00:21:06.290017667Z","provider":"osv","references":["https://ubuntu.com/security/CVE-2026-102579","https://www.cve.org/CVERecord?id=CVE-2026-102579","https://access.redhat.com/security/cve/CVE-2026-102579","https://bugzilla.redhat.com/show_bug.cgi?id=2543633","https://moodle.org/mod/forum/discuss.php?d=482497"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4defc2af-8a9e-4996-b8f2-f446402515bb","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102579","advisory_id":"4defc2af-8a9e-4996-b8f2-f446402515bb","event_types":["advisory"],"published_at":"2026-10-25T14:36:29.934701+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/events/51941"},"members":[{"id":51941,"cve_ids":[],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102579","summary":"A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course that they should not have permission to view. This issue leads to unauthorized information disclosure.","evidence":"osv:UBUNTU-CVE-2026-102579","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"unknown","structured":{"id":"UBUNTU-CVE-2026-102579","aliases":["UBUNTU-CVE-2026-102579"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102579.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102579.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-01T00:21:06.290017667Z","provider":"osv","references":["https://ubuntu.com/security/CVE-2026-102579","https://www.cve.org/CVERecord?id=CVE-2026-102579","https://access.redhat.com/security/cve/CVE-2026-102579","https://bugzilla.redhat.com/show_bug.cgi?id=2543633","https://moodle.org/mod/forum/discuss.php?d=482497"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4defc2af-8a9e-4996-b8f2-f446402515bb","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102579","advisory_id":"4defc2af-8a9e-4996-b8f2-f446402515bb","event_types":["advisory"],"published_at":"2026-10-25T14:36:29.934701+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/events/51941"}]}},{"id":52412,"cve_ids":[],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102584","summary":"A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores.","evidence":"osv:UBUNTU-CVE-2026-102584","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"unknown","structured":{"id":"UBUNTU-CVE-2026-102584","aliases":["UBUNTU-CVE-2026-102584"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102584.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102584.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-01T00:21:06.125987218Z","provider":"osv","references":["https://ubuntu.com/security/CVE-2026-102584","https://www.cve.org/CVERecord?id=CVE-2026-102584","https://access.redhat.com/security/cve/CVE-2026-102584","https://bugzilla.redhat.com/show_bug.cgi?id=2543637","https://moodle.org/mod/forum/discuss.php?d=482502"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:650d8313-f8ea-45d5-a5f9-bd3cac2c4ef9","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102584","advisory_id":"650d8313-f8ea-45d5-a5f9-bd3cac2c4ef9","event_types":["advisory"],"published_at":"2026-10-25T14:36:28.861409+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/advisories/advisory%3A650d8313-f8ea-45d5-a5f9-bd3cac2c4ef9","group":{"id":"advisory:650d8313-f8ea-45d5-a5f9-bd3cac2c4ef9","revision":1,"primary_event_id":51940,"change":"published","superseded_by":[],"changed":{"id":51940,"cve_ids":[],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102584","summary":"A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores.","evidence":"osv:UBUNTU-CVE-2026-102584","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"unknown","structured":{"id":"UBUNTU-CVE-2026-102584","aliases":["UBUNTU-CVE-2026-102584"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102584.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102584.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-01T00:21:06.125987218Z","provider":"osv","references":["https://ubuntu.com/security/CVE-2026-102584","https://www.cve.org/CVERecord?id=CVE-2026-102584","https://access.redhat.com/security/cve/CVE-2026-102584","https://bugzilla.redhat.com/show_bug.cgi?id=2543637","https://moodle.org/mod/forum/discuss.php?d=482502"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:650d8313-f8ea-45d5-a5f9-bd3cac2c4ef9","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102584","advisory_id":"650d8313-f8ea-45d5-a5f9-bd3cac2c4ef9","event_types":["advisory"],"published_at":"2026-10-25T14:36:28.861409+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/events/51940"},"members":[{"id":51940,"cve_ids":[],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102584","summary":"A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores.","evidence":"osv:UBUNTU-CVE-2026-102584","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"unknown","structured":{"id":"UBUNTU-CVE-2026-102584","aliases":["UBUNTU-CVE-2026-102584"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102584.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102584.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-01T00:21:06.125987218Z","provider":"osv","references":["https://ubuntu.com/security/CVE-2026-102584","https://www.cve.org/CVERecord?id=CVE-2026-102584","https://access.redhat.com/security/cve/CVE-2026-102584","https://bugzilla.redhat.com/show_bug.cgi?id=2543637","https://moodle.org/mod/forum/discuss.php?d=482502"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:650d8313-f8ea-45d5-a5f9-bd3cac2c4ef9","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102584","advisory_id":"650d8313-f8ea-45d5-a5f9-bd3cac2c4ef9","event_types":["advisory"],"published_at":"2026-10-25T14:36:28.861409+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/events/51940"}]}},{"id":52411,"cve_ids":[],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102588","summary":"A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthorized requests on the victim's behalf. This flaw allows a remote attacker to set or overwrite student grades without authorization.","evidence":"osv:UBUNTU-CVE-2026-102588","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"unknown","structured":{"id":"UBUNTU-CVE-2026-102588","aliases":["UBUNTU-CVE-2026-102588"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102588.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102588.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-01T00:21:06.288703988Z","provider":"osv","references":["https://ubuntu.com/security/CVE-2026-102588","https://www.cve.org/CVERecord?id=CVE-2026-102588","https://access.redhat.com/security/cve/CVE-2026-102588","https://bugzilla.redhat.com/show_bug.cgi?id=2543643","https://moodle.org/mod/forum/discuss.php?d=482507"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:5d0e4768-b6f6-4086-b115-40127f46cd89","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102588","advisory_id":"5d0e4768-b6f6-4086-b115-40127f46cd89","event_types":["advisory"],"published_at":"2026-10-25T14:36:28.039957+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/advisories/advisory%3A5d0e4768-b6f6-4086-b115-40127f46cd89","group":{"id":"advisory:5d0e4768-b6f6-4086-b115-40127f46cd89","revision":1,"primary_event_id":51939,"change":"published","superseded_by":[],"changed":{"id":51939,"cve_ids":[],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102588","summary":"A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthorized requests on the victim's behalf. This flaw allows a remote attacker to set or overwrite student grades without authorization.","evidence":"osv:UBUNTU-CVE-2026-102588","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"unknown","structured":{"id":"UBUNTU-CVE-2026-102588","aliases":["UBUNTU-CVE-2026-102588"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102588.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102588.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-01T00:21:06.288703988Z","provider":"osv","references":["https://ubuntu.com/security/CVE-2026-102588","https://www.cve.org/CVERecord?id=CVE-2026-102588","https://access.redhat.com/security/cve/CVE-2026-102588","https://bugzilla.redhat.com/show_bug.cgi?id=2543643","https://moodle.org/mod/forum/discuss.php?d=482507"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:5d0e4768-b6f6-4086-b115-40127f46cd89","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102588","advisory_id":"5d0e4768-b6f6-4086-b115-40127f46cd89","event_types":["advisory"],"published_at":"2026-10-25T14:36:28.039957+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/events/51939"},"members":[{"id":51939,"cve_ids":[],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102588","summary":"A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthorized requests on the victim's behalf. This flaw allows a remote attacker to set or overwrite student grades without authorization.","evidence":"osv:UBUNTU-CVE-2026-102588","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"unknown","structured":{"id":"UBUNTU-CVE-2026-102588","aliases":["UBUNTU-CVE-2026-102588"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102588.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102588.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-01T00:21:06.288703988Z","provider":"osv","references":["https://ubuntu.com/security/CVE-2026-102588","https://www.cve.org/CVERecord?id=CVE-2026-102588","https://access.redhat.com/security/cve/CVE-2026-102588","https://bugzilla.redhat.com/show_bug.cgi?id=2543643","https://moodle.org/mod/forum/discuss.php?d=482507"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:5d0e4768-b6f6-4086-b115-40127f46cd89","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102588","advisory_id":"5d0e4768-b6f6-4086-b115-40127f46cd89","event_types":["advisory"],"published_at":"2026-10-25T14:36:28.039957+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/events/51939"}]}},{"id":52410,"cve_ids":[],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102583","summary":"A flaw was found in Moodle. An incorrect capability check in the artificial intelligence (AI) editor placement's image generation web service allows an authenticated user to invoke the feature without holding the required capability. This flaw permits unauthorized users to access and utilize the AI image generation functionality.","evidence":"osv:UBUNTU-CVE-2026-102583","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"unknown","structured":{"id":"UBUNTU-CVE-2026-102583","aliases":["UBUNTU-CVE-2026-102583"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102583.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102583.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-01T00:21:06.120972319Z","provider":"osv","references":["https://ubuntu.com/security/CVE-2026-102583","https://www.cve.org/CVERecord?id=CVE-2026-102583","https://access.redhat.com/security/cve/CVE-2026-102583","https://bugzilla.redhat.com/show_bug.cgi?id=2543640","https://moodle.org/mod/forum/discuss.php?d=482501"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:85e9f039-fc5f-4847-ab87-ab8f1a2fde3e","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102583","advisory_id":"85e9f039-fc5f-4847-ab87-ab8f1a2fde3e","event_types":["advisory"],"published_at":"2026-10-25T14:36:27.383129+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/advisories/advisory%3A85e9f039-fc5f-4847-ab87-ab8f1a2fde3e","group":{"id":"advisory:85e9f039-fc5f-4847-ab87-ab8f1a2fde3e","revision":1,"primary_event_id":51938,"change":"published","superseded_by":[],"changed":{"id":51938,"cve_ids":[],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102583","summary":"A flaw was found in Moodle. An incorrect capability check in the artificial intelligence (AI) editor placement's image generation web service allows an authenticated user to invoke the feature without holding the required capability. This flaw permits unauthorized users to access and utilize the AI image generation functionality.","evidence":"osv:UBUNTU-CVE-2026-102583","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"unknown","structured":{"id":"UBUNTU-CVE-2026-102583","aliases":["UBUNTU-CVE-2026-102583"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102583.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102583.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-01T00:21:06.120972319Z","provider":"osv","references":["https://ubuntu.com/security/CVE-2026-102583","https://www.cve.org/CVERecord?id=CVE-2026-102583","https://access.redhat.com/security/cve/CVE-2026-102583","https://bugzilla.redhat.com/show_bug.cgi?id=2543640","https://moodle.org/mod/forum/discuss.php?d=482501"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:85e9f039-fc5f-4847-ab87-ab8f1a2fde3e","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102583","advisory_id":"85e9f039-fc5f-4847-ab87-ab8f1a2fde3e","event_types":["advisory"],"published_at":"2026-10-25T14:36:27.383129+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/events/51938"},"members":[{"id":51938,"cve_ids":[],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102583","summary":"A flaw was found in Moodle. An incorrect capability check in the artificial intelligence (AI) editor placement's image generation web service allows an authenticated user to invoke the feature without holding the required capability. This flaw permits unauthorized users to access and utilize the AI image generation functionality.","evidence":"osv:UBUNTU-CVE-2026-102583","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"unknown","structured":{"id":"UBUNTU-CVE-2026-102583","aliases":["UBUNTU-CVE-2026-102583"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102583.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102583.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-01T00:21:06.120972319Z","provider":"osv","references":["https://ubuntu.com/security/CVE-2026-102583","https://www.cve.org/CVERecord?id=CVE-2026-102583","https://access.redhat.com/security/cve/CVE-2026-102583","https://bugzilla.redhat.com/show_bug.cgi?id=2543640","https://moodle.org/mod/forum/discuss.php?d=482501"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:85e9f039-fc5f-4847-ab87-ab8f1a2fde3e","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102583","advisory_id":"85e9f039-fc5f-4847-ab87-ab8f1a2fde3e","event_types":["advisory"],"published_at":"2026-10-25T14:36:27.383129+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/events/51938"}]}},{"id":52409,"cve_ids":[],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102587","summary":"A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure by inferring hidden user data.","evidence":"osv:UBUNTU-CVE-2026-102587","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"unknown","structured":{"id":"UBUNTU-CVE-2026-102587","aliases":["UBUNTU-CVE-2026-102587"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102587.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102587.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-01T00:21:06.119492536Z","provider":"osv","references":["https://ubuntu.com/security/CVE-2026-102587","https://www.cve.org/CVERecord?id=CVE-2026-102587","https://access.redhat.com/security/cve/CVE-2026-102587","https://bugzilla.redhat.com/show_bug.cgi?id=2543642","https://moodle.org/mod/forum/discuss.php?d=482506"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:56f1acfb-57b1-42df-9b09-57dfe7ba1b46","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102587","advisory_id":"56f1acfb-57b1-42df-9b09-57dfe7ba1b46","event_types":["advisory"],"published_at":"2026-10-25T14:36:26.667788+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/advisories/advisory%3A56f1acfb-57b1-42df-9b09-57dfe7ba1b46","group":{"id":"advisory:56f1acfb-57b1-42df-9b09-57dfe7ba1b46","revision":1,"primary_event_id":51937,"change":"published","superseded_by":[],"changed":{"id":51937,"cve_ids":[],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102587","summary":"A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure by inferring hidden user data.","evidence":"osv:UBUNTU-CVE-2026-102587","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"unknown","structured":{"id":"UBUNTU-CVE-2026-102587","aliases":["UBUNTU-CVE-2026-102587"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102587.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102587.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-01T00:21:06.119492536Z","provider":"osv","references":["https://ubuntu.com/security/CVE-2026-102587","https://www.cve.org/CVERecord?id=CVE-2026-102587","https://access.redhat.com/security/cve/CVE-2026-102587","https://bugzilla.redhat.com/show_bug.cgi?id=2543642","https://moodle.org/mod/forum/discuss.php?d=482506"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:56f1acfb-57b1-42df-9b09-57dfe7ba1b46","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102587","advisory_id":"56f1acfb-57b1-42df-9b09-57dfe7ba1b46","event_types":["advisory"],"published_at":"2026-10-25T14:36:26.667788+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/events/51937"},"members":[{"id":51937,"cve_ids":[],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102587","summary":"A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure by inferring hidden user data.","evidence":"osv:UBUNTU-CVE-2026-102587","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"unknown","structured":{"id":"UBUNTU-CVE-2026-102587","aliases":["UBUNTU-CVE-2026-102587"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102587.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102587.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-01T00:21:06.119492536Z","provider":"osv","references":["https://ubuntu.com/security/CVE-2026-102587","https://www.cve.org/CVERecord?id=CVE-2026-102587","https://access.redhat.com/security/cve/CVE-2026-102587","https://bugzilla.redhat.com/show_bug.cgi?id=2543642","https://moodle.org/mod/forum/discuss.php?d=482506"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:56f1acfb-57b1-42df-9b09-57dfe7ba1b46","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102587","advisory_id":"56f1acfb-57b1-42df-9b09-57dfe7ba1b46","event_types":["advisory"],"published_at":"2026-10-25T14:36:26.667788+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/events/51937"}]}},{"id":52408,"cve_ids":[],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102585","summary":"A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses they do not have authorization to access.","evidence":"osv:UBUNTU-CVE-2026-102585","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"unknown","structured":{"id":"UBUNTU-CVE-2026-102585","aliases":["UBUNTU-CVE-2026-102585"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102585.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102585.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-01T00:21:06.044119972Z","provider":"osv","references":["https://ubuntu.com/security/CVE-2026-102585","https://www.cve.org/CVERecord?id=CVE-2026-102585","https://access.redhat.com/security/cve/CVE-2026-102585","https://bugzilla.redhat.com/show_bug.cgi?id=2543639","https://moodle.org/mod/forum/discuss.php?d=482503"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7acfdb52-d97c-4fd5-91d2-65bf70218197","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102585","advisory_id":"7acfdb52-d97c-4fd5-91d2-65bf70218197","event_types":["advisory"],"published_at":"2026-10-25T14:36:25.960245+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/advisories/advisory%3A7acfdb52-d97c-4fd5-91d2-65bf70218197","group":{"id":"advisory:7acfdb52-d97c-4fd5-91d2-65bf70218197","revision":1,"primary_event_id":51936,"change":"published","superseded_by":[],"changed":{"id":51936,"cve_ids":[],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102585","summary":"A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses they do not have authorization to access.","evidence":"osv:UBUNTU-CVE-2026-102585","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"unknown","structured":{"id":"UBUNTU-CVE-2026-102585","aliases":["UBUNTU-CVE-2026-102585"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102585.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102585.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-01T00:21:06.044119972Z","provider":"osv","references":["https://ubuntu.com/security/CVE-2026-102585","https://www.cve.org/CVERecord?id=CVE-2026-102585","https://access.redhat.com/security/cve/CVE-2026-102585","https://bugzilla.redhat.com/show_bug.cgi?id=2543639","https://moodle.org/mod/forum/discuss.php?d=482503"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7acfdb52-d97c-4fd5-91d2-65bf70218197","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102585","advisory_id":"7acfdb52-d97c-4fd5-91d2-65bf70218197","event_types":["advisory"],"published_at":"2026-10-25T14:36:25.960245+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/events/51936"},"members":[{"id":51936,"cve_ids":[],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2026-102585","summary":"A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses they do not have authorization to access.","evidence":"osv:UBUNTU-CVE-2026-102585","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"},{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/versions"}]}],"severity":"unknown","structured":{"id":"UBUNTU-CVE-2026-102585","aliases":["UBUNTU-CVE-2026-102585"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102585.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102585.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}]}}],"modified":"2026-10-01T00:21:06.044119972Z","provider":"osv","references":["https://ubuntu.com/security/CVE-2026-102585","https://www.cve.org/CVERecord?id=CVE-2026-102585","https://access.redhat.com/security/cve/CVE-2026-102585","https://bugzilla.redhat.com/show_bug.cgi?id=2543639","https://moodle.org/mod/forum/discuss.php?d=482503"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7acfdb52-d97c-4fd5-91d2-65bf70218197","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2026-102585","advisory_id":"7acfdb52-d97c-4fd5-91d2-65bf70218197","event_types":["advisory"],"published_at":"2026-10-25T14:36:25.960245+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T09:17:00+00:00","detail_url":"/events/51936"}]}},{"id":14290,"cve_ids":[],"payload":{"kind":"advisory","title":"moodle vulnerability","summary":"It was discovered that Moodle did not properly restrict URLs. An authenticated user could possibly use this issue to perform a server-side request forgery attack and expose sensitive information.","evidence":"osv:USN-8805-1","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"}]}],"severity":"unknown","structured":{"id":"USN-8805-1","aliases":["USN-8805-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3+dfsg-0ubuntu1+esm1"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8805-1.json","cves_map":{"cves":[{"id":"CVE-2019-3809","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}]}],"ecosystem":"Ubuntu:Pro:16.04:LTS"}},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}],"availability":"Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3+dfsg-0ubuntu1+esm1"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8805-1.json","cves_map":{"cves":[{"id":"CVE-2019-3809","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}]}],"ecosystem":"Ubuntu:Pro:18.04:LTS"}},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}],"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro"}}],"modified":"2026-09-24T18:41:45.233525360Z","provider":"osv","references":["https://ubuntu.com/security/notices/USN-8805-1","https://ubuntu.com/security/CVE-2019-3809"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8ffea305-ce8f-4d8c-ae8f-66697b61a445","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/USN-8805-1","advisory_id":"8ffea305-ce8f-4d8c-ae8f-66697b61a445","event_types":["advisory"],"published_at":"2026-10-25T00:37:49.24044+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-23T14:43:05+00:00","detail_url":"/advisories/advisory%3A8ffea305-ce8f-4d8c-ae8f-66697b61a445","group":{"id":"advisory:8ffea305-ce8f-4d8c-ae8f-66697b61a445","revision":1,"primary_event_id":14206,"change":"published","superseded_by":[],"changed":{"id":14206,"cve_ids":[],"payload":{"kind":"advisory","title":"moodle vulnerability","summary":"It was discovered that Moodle did not properly restrict URLs. An authenticated user could possibly use this issue to perform a server-side request forgery attack and expose sensitive information.","evidence":"osv:USN-8805-1","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"}]}],"severity":"unknown","structured":{"id":"USN-8805-1","aliases":["USN-8805-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3+dfsg-0ubuntu1+esm1"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8805-1.json","cves_map":{"cves":[{"id":"CVE-2019-3809","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}]}],"ecosystem":"Ubuntu:Pro:16.04:LTS"}},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}],"availability":"Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3+dfsg-0ubuntu1+esm1"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8805-1.json","cves_map":{"cves":[{"id":"CVE-2019-3809","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}]}],"ecosystem":"Ubuntu:Pro:18.04:LTS"}},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}],"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro"}}],"modified":"2026-09-24T18:41:45.233525360Z","provider":"osv","references":["https://ubuntu.com/security/notices/USN-8805-1","https://ubuntu.com/security/CVE-2019-3809"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8ffea305-ce8f-4d8c-ae8f-66697b61a445","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/USN-8805-1","advisory_id":"8ffea305-ce8f-4d8c-ae8f-66697b61a445","event_types":["advisory"],"published_at":"2026-10-25T00:37:49.24044+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-23T14:43:05+00:00","detail_url":"/events/14206"},"members":[{"id":14206,"cve_ids":[],"payload":{"kind":"advisory","title":"moodle vulnerability","summary":"It was discovered that Moodle did not properly restrict URLs. An authenticated user could possibly use this issue to perform a server-side request forgery attack and expose sensitive information.","evidence":"osv:USN-8805-1","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"}]}],"severity":"unknown","structured":{"id":"USN-8805-1","aliases":["USN-8805-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3+dfsg-0ubuntu1+esm1"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8805-1.json","cves_map":{"cves":[{"id":"CVE-2019-3809","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}]}],"ecosystem":"Ubuntu:Pro:16.04:LTS"}},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}],"availability":"Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3+dfsg-0ubuntu1+esm1"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8805-1.json","cves_map":{"cves":[{"id":"CVE-2019-3809","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}]}],"ecosystem":"Ubuntu:Pro:18.04:LTS"}},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}],"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro"}}],"modified":"2026-09-24T18:41:45.233525360Z","provider":"osv","references":["https://ubuntu.com/security/notices/USN-8805-1","https://ubuntu.com/security/CVE-2019-3809"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8ffea305-ce8f-4d8c-ae8f-66697b61a445","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/USN-8805-1","advisory_id":"8ffea305-ce8f-4d8c-ae8f-66697b61a445","event_types":["advisory"],"published_at":"2026-10-25T00:37:49.24044+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-23T14:43:05+00:00","detail_url":"/events/14206"}]}},{"id":14267,"cve_ids":[],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2019-3809","summary":"A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed setting the URL of badges, when it should be restricted to the Mozilla Open Badges backpack URL. This resulted in the possibility of blind SSRF via requests made by the page.","evidence":"osv:UBUNTU-CVE-2019-3809","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"}]}],"severity":"unknown","structured":{"id":"UBUNTU-CVE-2019-3809","aliases":["UBUNTU-CVE-2019-3809"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3+dfsg-0ubuntu1+esm1"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-3809.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}],"availability":"Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3+dfsg-0ubuntu1+esm1"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-3809.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}],"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro"}}],"modified":"2026-09-24T18:26:43.428800872Z","provider":"osv","references":["https://ubuntu.com/security/CVE-2019-3809","https://moodle.org/mod/forum/discuss.php?d=381229#p1536766","https://www.cve.org/CVERecord?id=CVE-2019-3809","https://ubuntu.com/security/notices/USN-8805-1"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:51898514-eed8-4502-806e-bee076517342","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2019-3809","advisory_id":"51898514-eed8-4502-806e-bee076517342","event_types":["advisory"],"published_at":"2026-10-25T00:37:36.082438+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2019-03-25T18:29:00+00:00","detail_url":"/advisories/advisory%3A51898514-eed8-4502-806e-bee076517342","group":{"id":"advisory:51898514-eed8-4502-806e-bee076517342","revision":1,"primary_event_id":14185,"change":"published","superseded_by":[],"changed":{"id":14185,"cve_ids":[],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2019-3809","summary":"A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed setting the URL of badges, when it should be restricted to the Mozilla Open Badges backpack URL. This resulted in the possibility of blind SSRF via requests made by the page.","evidence":"osv:UBUNTU-CVE-2019-3809","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"}]}],"severity":"unknown","structured":{"id":"UBUNTU-CVE-2019-3809","aliases":["UBUNTU-CVE-2019-3809"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3+dfsg-0ubuntu1+esm1"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-3809.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}],"availability":"Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3+dfsg-0ubuntu1+esm1"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-3809.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}],"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro"}}],"modified":"2026-09-24T18:26:43.428800872Z","provider":"osv","references":["https://ubuntu.com/security/CVE-2019-3809","https://moodle.org/mod/forum/discuss.php?d=381229#p1536766","https://www.cve.org/CVERecord?id=CVE-2019-3809","https://ubuntu.com/security/notices/USN-8805-1"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:51898514-eed8-4502-806e-bee076517342","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2019-3809","advisory_id":"51898514-eed8-4502-806e-bee076517342","event_types":["advisory"],"published_at":"2026-10-25T00:37:36.082438+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2019-03-25T18:29:00+00:00","detail_url":"/events/14185"},"members":[{"id":14185,"cve_ids":[],"payload":{"kind":"advisory","title":"UBUNTU-CVE-2019-3809","summary":"A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed setting the URL of badges, when it should be restricted to the Mozilla Open Badges backpack URL. This resulted in the possibility of blind SSRF via requests made by the page.","evidence":"osv:UBUNTU-CVE-2019-3809","products":[{"name":{"value":"moodle","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.7.9+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.10+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-1","evidence":"/affected/0/versions"},{"value":"2.7.11+dfsg-2","evidence":"/affected/0/versions"},{"value":"2.7.12+dfsg-1","evidence":"/affected/0/versions"},{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/0/versions"}]},{"name":{"value":"moodle","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.3+dfsg-0ubuntu1+esm1","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"3.0.3+dfsg-0ubuntu1","evidence":"/affected/1/versions"}]}],"severity":"unknown","structured":{"id":"UBUNTU-CVE-2019-3809","aliases":["UBUNTU-CVE-2019-3809"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3+dfsg-0ubuntu1+esm1"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial","ecosystem":"Ubuntu:Pro:16.04:LTS"},"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-3809.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}],"availability":"Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3+dfsg-0ubuntu1+esm1"}]}],"package":{"name":"moodle","purl":"pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic","ecosystem":"Ubuntu:Pro:18.04:LTS"},"versions":["3.0.3+dfsg-0ubuntu1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-3809.json"},"ecosystem_specific":{"binaries":[{"binary_name":"moodle","binary_version":"3.0.3+dfsg-0ubuntu1+esm1"}],"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro"}}],"modified":"2026-09-24T18:26:43.428800872Z","provider":"osv","references":["https://ubuntu.com/security/CVE-2019-3809","https://moodle.org/mod/forum/discuss.php?d=381229#p1536766","https://www.cve.org/CVERecord?id=CVE-2019-3809","https://ubuntu.com/security/notices/USN-8805-1"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:51898514-eed8-4502-806e-bee076517342","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/UBUNTU-CVE-2019-3809","advisory_id":"51898514-eed8-4502-806e-bee076517342","event_types":["advisory"],"published_at":"2026-10-25T00:37:36.082438+00:00","technologies":["core-osv","moodle"],"context_update":false,"extraction_method":"structured","source_published_at":"2019-03-25T18:29:00+00:00","detail_url":"/events/14185"}]}}],"next_after":76340,"next_before":14267}