CVE-2026-102580: Moodle: arbitrary class instantiation via report builder audience classname
A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected application behavior.
Other sources
A flaw was found in Moodle's report builder (corereportbuilder). Insufficient validation of the audience classname allowed arbitrary class instantiation. No exploitable gadget chain leading to a stronger impact (e.g. code execution or data disclosure) has been demonstrated; the flaw is treated here as instantiation of an arbitrary class with no confirmed further primitive.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker must be authenticated and have high privileges. Exploitation also has high attack complexity, according to the supplied CVSS vector.
What impact has been confirmed?
The confirmed effect is arbitrary instantiation of internal program objects through an improperly validated audience class name in Report Builder. No gadget chain producing stronger effects such as code execution or data disclosure has been demonstrated.
Which component should be reviewed for exposure?
Review Moodle's core_reportbuilder component, specifically functionality that accepts or processes an audience classname. The provided data does not state whether a default configuration is affected.