CVE-2026-113607: Configurable Reports block for Moodle before 5.3.0 Authorization Bypass via get_report_data
Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the blockconfigurablereportsgetreportdata web service. When checkpermissions fails, the function only adds a warning and still returns the full report table, letting any logged-in user supply arbitrary report ids to read SQL reports over user and grade data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Configurable Reports block for Moodleto a version that resolves this vulnerability.Fixed in 5.3.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Moodle user can exploit it. The user only needs to be able to call the block_configurable_reports_get_report_data web service and provide the ID of a restricted report.
What information could be exposed?
Restricted SQL reports can be returned despite a failed permission check. The described affected reports may expose user and grade data.
Are installations using an unmodified affected release exposed by default?
The vulnerability is in the web service behavior before version 5.3.0: a failed check_permissions result produces a warning but does not stop the report data from being returned. Exposure depends on restricted reports being available for an authenticated user to request by report ID.
How can I determine whether an installation is affected?
Check the installed Configurable Reports block version; versions before 5.3.0 are affected. You can also review the implementation of block_configurable_reports_get_report_data: affected code continues to return the full report table after check_permissions fails.