CVE-2026-102583: Moodle: incorrect capability check in ai generate image web service
A flaw was found in Moodle. An incorrect capability check in the AI editor placement's "generate image" web service allowed a user to invoke that feature without holding the required capability. The advisory does not state the exact privilege level of an affected user; this draft assumes access is limited to users who already hold some content-editing role rather than a fully anonymous or lowest-privilege user.
Other sources
A flaw was found in Moodle. An incorrect capability check in the artificial intelligence (AI) editor placement's image generation web service allows an authenticated user to invoke the feature without holding the required capability. This flaw permits unauthorized users to access and utilize the AI image generation functionality.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Does exploitation require an authenticated Moodle account?
Yes. The flaw allows an authenticated user to invoke the AI image-generation web service without the capability normally required for that feature.
Which users should be considered potentially exposed?
The advisory does not specify the exact privilege level required to reach the affected service. The available information indicates the issue is relevant to users with some content-editing access rather than anonymous users, but this is an assumption in the draft rather than a confirmed requirement.
What is the security impact of successful exploitation?
A user who lacks the required capability can access and use the AI image-generation functionality. The provided information does not describe confidentiality impact, data exposure, or service disruption.