Medium
Moodle: user profile information disclosure via grade web service
Type: advisorySources: OSV
A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course that they should not have permission to view. This issue leads to unauthorized information disclosure.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-102579
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 5 Nov 2026, 16:57 UTC · Revision 1
Source evidence
Moodle: user profile information disclosure via grade web service
core-osv · Original sourcePublished 30 Sept 2026, 08:36 UTC
A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course that they should not have permission to view. This issue leads to unauthorized information disclosure.
osv:CVE-2026-102579
Complete source record
{
"id": "2607bc08b5692c4cae77c5f8a4acbbeb9f4f21a5c0357c39a3c1aa6b943f625c",
"url": "https://osv.dev/vulnerability/CVE-2026-102579",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Moodle: user profile information disclosure via grade web service",
"summary": "A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course that they should not have permission to view. This issue leads to unauthorized information disclosure.",
"evidence": "osv:CVE-2026-102579",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-102579",
"aliases": [
"BIT-moodle-2026-102579",
"CVE-2026-102579"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/moodle/moodle",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "8cbae18a2898cfd8266ec91ac206e12004f0ff5f"
},
{
"introduced": "78e860178314c45441a21e0b99455400b8283d48"
},
{
"fixed": "152bf2ebbdd1f994331af21c80332b8d9051581c"
},
{
"introduced": "eb47eff0719455a7e1f7a9805bc75dad3f6b3995"
},
{
"fixed": "17513f6614237b530de7903fe32117fa026384c2"
},
{
"introduced": "c197f31fd89bf5dd5ba41661b06660167e419099"
},
{
"fixed": "acfa383c13dd46c83ca82894a8e95fac273fda33"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "4.5.13"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.0.9"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.1.0"
},
{
"fixed": "5.1.6"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.2.0"
},
{
"fixed": "5.2.2"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v4.5.12",
"v5.2.1",
"v5.1.5",
"v5.0.8",
"v4.5.11",
"v5.1.4",
"v5.2.0",
"v5.0.7",
"v5.0.6",
"v5.1.3",
"v5.0.5",
"v5.1.2",
"v4.5.9",
"v4.5.10",
"v5.1.1",
"v5.0.4",
"v4.5.8",
"v4.5.7",
"v5.1.0",
"v5.0.3",
"v4.5.6",
"v5.0.2",
"v4.5.5",
"v5.0.1",
"v5.0.0",
"v4.5.4",
"v4.5.3",
"v4.5.2",
"v4.5.1",
"v4.5.0",
"v4.5.0-rc2",
"v4.5.0-rc1",
"v4.5.0-beta",
"v4.4.0",
"v4.4.0-rc2",
"v4.4.0-rc1",
"v4.4.0-beta",
"v4.3.0",
"v4.3.0-rc2",
"v4.3.0-rc1",
"v4.3.0-beta",
"v4.2.0",
"v4.2.0-rc2",
"v4.2.0-rc1",
"v4.2.0-beta",
"v4.1.0-beta",
"v4.1.0",
"v4.1.0-rc3",
"v4.1.0-rc2",
"v4.1.0-rc1",
"v4.0.0",
"v4.0.0-rc2",
"v4.0.0-rc3",
"v4.0.0-rc4",
"v4.0.0-rc1",
"v4.0.0-beta",
"v3.9.0-rc2",
"v3.9.0",
"v3.9.0-rc3",
"v3.9.0-rc1",
"v3.9.0-beta",
"v3.8.0",
"v3.8.0-rc1",
"v3.8.0-beta",
"v3.7.0",
"v3.7.0-rc2",
"v3.7.0-rc1",
"v3.7.0-beta",
"v3.6.0",
"v3.6.0-rc2",
"v3.6.0-rc3",
"v3.6.0-rc1",
"v3.6.0-beta",
"v3.5.0",
"v3.5.0-rc1",
"v3.5.0-beta",
"v3.4.0",
"v3.4.0-rc2",
"v3.4.0-rc3",
"v3.4.0-rc1",
"v3.4.0-beta",
"v3.3.0",
"v3.3.0-rc3",
"v3.3.0-rc2",
"v3.3.0-rc1",
"v3.3.0-beta",
"v3.2.0-rc2",
"v3.2.0",
"v3.2.0-rc4",
"v3.2.0-beta",
"v3.2.0-rc5",
"v3.2.0-rc3",
"v3.2.0-rc1",
"v3.1.0-beta",
"v3.1.0",
"v3.1.0-rc2",
"v3.1.0-rc1",
"v3.0.0-rc3",
"v3.0.0",
"v3.0.0-rc4",
"v3.0.0-rc2",
"v3.0.0-rc1",
"v3.0.0-beta",
"v2.9.0",
"v2.9.0-rc2",
"v2.9.0-rc1",
"v2.9.0-beta",
"v2.8.0",
"v2.8.0-rc2",
"v2.8.0-rc1",
"v2.8.0-beta",
"v2.7.0",
"v2.7.0-rc2",
"v2.7.0-rc1",
"v2.7.0-beta",
"v2.6.0",
"v2.6.0-rc1",
"v2.6.0-beta",
"v2.5.0",
"v2.5.0-rc1",
"v2.5.0-beta",
"v2.4.0-beta",
"v2.4.0-rc1",
"v2.4.0",
"v2.3.0",
"v2.3.0-rc1",
"v2.3.0-beta",
"v2.2.0",
"v2.2.0-rc1",
"v2.2.0-beta",
"v2.1.0",
"v2.0.1",
"v2.0.0",
"v2.0.0-rc2",
"v2.0.0-rc1",
"v1.3.0",
"v1.2.1",
"v1.2.0",
"v1.1.1",
"v1.1.0",
"v1.0.9",
"v1.0.8",
"v1.0.7",
"v1.0.6",
"v1.0.5",
"v1.0.4",
"v1.0.3",
"v1.0.2",
"v1.0.1",
"v1.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102579.json"
}
}
],
"modified": "2026-10-28T02:30:44.497202572Z",
"provider": "osv",
"references": [
"https://git.moodle.org",
"https://moodle.org/mod/forum/discuss.php?d=482497",
"https://access.redhat.com/security/cve/CVE-2026-102579",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102579.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-102579",
"https://bugzilla.redhat.com/show_bug.cgi?id=2543633"
],
"provider_metadata": {
"cwe_ids": [
"CWE-359"
],
"cna_assigner": "fedora",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "5.2.0"
},
{
"fixed": "5.2.2"
},
{
"introduced": "5.1.0"
},
{
"fixed": "5.1.6"
},
{
"introduced": "5.0.0"
},
{
"fixed": "5.0.9"
},
{
"fixed": "4.5.13"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102579.json"
}
},
"related_cves": [
{
"value": "CVE-2026-102579",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 512485,
"published_at": "2026-09-30T08:36:04.097+00:00"
}