CVE-2026-102579: Moodle: user profile information disclosure via grade web service
A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course that they should not have permission to view. This issue leads to unauthorized information disclosure.
Other sources
A flaw was found in Moodle's grade web service. An incorrect capability check allowed a student to access profile information of other students enrolled in the same course, which they would not otherwise have access to.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated student can exploit it against other students enrolled in the same course. The issue is limited to profile information disclosure; the available data does not indicate modification or service disruption.
What access is required for an attacker?
The attacker needs a valid authenticated student account and must be enrolled in the same course as the students whose profile information they target. No user interaction is required.
How can administrators assess whether their Moodle deployment is exposed?
Review whether students can access the grade web service and test, using a student-role account, whether it can retrieve profile information for other students in the same course that the role should not be allowed to view. The vulnerability is caused by an incorrect capability check in that service.