UBUNTU-CVE-2026-119556: Medium severity ubuntu/moodle vulnerability
Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the coregradesgetgradeitems web service that allows enrolled students to view hidden grade items. Authenticated course users can call the AJAX or mobile web service to list hidden grade item ids, names, and categories that the gradebook conceals from them.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who is enrolled in a course can exploit it. The attacker needs access to the affected course and can use the AJAX or mobile web service.
What information can an attacker obtain?
The attacker can list hidden grade item IDs, names, and categories that are normally concealed by the gradebook. The provided data does not indicate exposure of grade values or modification of grades.
Are standard Moodle gradebook users affected, or is special configuration required?
Affected users are enrolled students or other authenticated course users where hidden grade items exist. No special configuration requirement is identified beyond use of an affected Moodle version and access to the core_grades_get_gradeitems web service.
How can administrators determine whether they are affected?
Check whether the Moodle deployment is running 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, or 5.3.0. Also review whether enrolled users can call the AJAX or mobile grade-items service and whether courses contain hidden grade items.