CVE-2026-102588: Moodle: csrf in xml grade import
A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthorized requests on the victim's behalf. This flaw allows a remote attacker to set or overwrite student grades without authorization.
Other sources
A flaw was found in Moodle. The XML grade import functionality, which allows setting or overwriting of student grades, did not include the token required to prevent a cross-site request forgery (CSRF) risk, allowing an attacker to overwrite grades on behalf of a logged-in victim who visits a malicious page.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this attack?
Authenticated Moodle users who have grade management permissions are the relevant targets. The attacker must induce such a user to visit a malicious webpage while the user is logged in.
What can an attacker do through successful exploitation?
An attacker can cause XML grade import requests to be submitted in the victim's session, allowing student grades to be set or overwritten without authorization.
Does exploitation require an attacker account or direct access to Moodle?
No privileges are required by the attacker. Exploitation is remote and requires user interaction: a logged-in user with grade management permissions must visit an attacker-controlled page.
How can we determine whether this feature is relevant in our environment?
Assess whether Moodle users can use the XML grade import functionality and which accounts hold grade management permissions. Those accounts are the ones whose authenticated sessions could be abused by this issue.