REDHAT-BUG-2543636: Low severity Moodle Moodle vulnerability
Published Sep 29, 2026
·Updated
A flaw was found in Moodle. The manual enrolment management page did not correctly observe the disabled state of the manual enrolment plugin, allowing direct access to the page when the plugin was disabled and no longer linked from the UI. The relevant enrolment capability was still required to access the page, limiting the practical impact.
Affected Software
1 affected component
Moodle Moodle
Event History
Sep 29, 2026
Data Sourced
via Red Hat·08:36 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Who can access the page when the manual enrolment plugin is disabled?
Only users who still hold the relevant enrolment capability can access it. The capability check remains in place, which limits practical impact.
2
How would someone reach the page if it is not available through the interface?
The page is no longer linked from the UI when the plugin is disabled, but it can still be reached through direct access to its URL.