CVE-2026-102582: Moodle: manual enrolment page accessible when plugin disabled
A flaw was found in Moodle. The manual enrolment management page did not correctly observe the disabled state of the manual enrolment plugin, allowing direct access to the page when the plugin was disabled and no longer linked from the UI. The relevant enrolment capability was still required to access the page, limiting the practical impact.
Other sources
A flaw was found in Moodle. The manual enrolment management page did not properly check whether the manual enrolment plugin was disabled, allowing users with enrolment permissions to access the page directly by navigating to its URL. Consequently, an authorized user could manage manual enrolments even after an administrator disabled the feature in the user interface.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A user must already have the relevant enrolment capability. The issue does not grant enrolment permissions to users who do not already have them.
Is a disabled manual enrolment plugin fully unavailable?
No. Disabling the plugin removes its normal user-interface link, but affected users with enrolment permissions can still reach the manual enrolment management page directly by URL.
What is the practical impact?
Authorized users may manage manual enrolments despite an administrator having disabled the manual enrolment feature. The impact is limited by the existing capability requirement.