UBUNTU-CVE-2026-119555: Medium severity ubuntu/moodle vulnerability
Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain an information disclosure vulnerability in the coregradesgetfeedback web service. The service lacks group-membership and enrolment checks, so non-editing teachers can iterate userid values to read other groups' grade feedback and users' names and identity fields such as email.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A non-editing teacher can exploit it through the core_grades_get_feedback web service. The issue enables that role to iterate user ID values and access information belonging to users in other groups.
What information can be exposed?
The exposed data includes grade feedback, users' names, and identity fields such as email addresses. The vulnerability is an information disclosure issue; no integrity or availability impact is described.
Which Moodle releases are affected?
Affected releases are Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0.
How can administrators assess whether they may already be affected?
Review whether non-editing teachers can call the core_grades_get_feedback web service and whether they have access to courses with separate groups or users outside their assigned groups. The reported behavior involves iterating userid values to retrieve cross-group feedback and identity data.