CVE-2026-102585: Moodle: group validation missing when enrolling user to course
A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses they do not have authorization to access.
Other sources
A flaw was found in Moodle. When enrolling a user into a course while selecting a group, a check that the selected group actually belonged to that course was missing, allowing a teacher to add users to groups in courses the teacher could not otherwise access.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with teacher privileges can exploit it. The issue is relevant where that user can enroll users in a course and assign them to groups.
What access does exploitation provide?
A teacher can add users to groups belonging to courses that the teacher is not authorized to access. The described impact is unauthorized group membership assignment rather than disclosure or service disruption.
How can administrators identify potentially affected activity?
Review course enrollment actions performed by teacher-privileged accounts that included group assignments. Look for cases where the assigned group belonged to a different course than the course in which the enrollment was made.