A flaw was found in Moodle. Insufficient access control checks on H5P content files allow unauthenticated remote attackers to view restricted materials, including content stored in the system context and files belonging to hidden or unavailable course modules. This issue results in unauthorized information disclosure of protected content.

A flaw was found in Moodle's H5P content handling. Insufficient access checks on H5P content files, including extracted and repackaged content stored in the system context and files belonging to hidden or unavailable course modules, could allow users, including those who were not logged in, to view H5P content they did not have permission to access.

Configurable Reports block for Moodle (moodle-blockconfigurablereports) before 5.3.1 contains an sql injection vulnerability in reportsql::preparesql() via the filtervar request parameter of viewreport.php. Low-privileged users permitted to view reports using the %%FILTERVAR%% placeholder can inject subqueries or UNION SELECT to read arbitrary database tables, including user password hashes.

Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the blockconfigurablereportsgetreportdata web service. When checkpermissions fails, the function only adds a warning and still returns the full report table, letting any logged-in user supply arbitrary report ids to read SQL reports over user and grade data.

End of life: 10/1/2029, End of support: 10/4/2027, Latest version: 5.3.0

Hi!

greetings, Daniel

On 29/09/2026 09:42, Michael Straßberger wrote: Hello,

3.9.2 is a very old version. The latest in that minor release is from 8 Dec 2023 (3.9.25). According to https://download.moodle.org/releases/security/ it does not even have Security Support any more.

Is this Behaviour reproducible in at least Moodle 4.1.22? If not I don't think a CVE should be issued here, since it would only increase the Noise. The Influx of CVE's and advisory is high as is and I don't think it's beneficial to issue even more for software version that are way beyond EOL.

On Mon, 2026-09-28 at 22:34 +0500, Muhammad Arslan Official wrote: Hello,

I am disclosing a vulnerability in Moodle LMS and requesting a CVE ID, as the vendor (a registered CNA) has not assigned one after coordinated disclosure, and a MITRE CNA-LR request (CAN-2026-2032565) has been under review for ~3 months without response.

Product: Moodle LMS Confirmed version: 3.9.2 (other versions not yet verified) Class: CWE-434 / CWE-20 - Unrestricted file upload / improper input validation Privilege required: authenticated, Student-level account Vendor status: reported via Bugcrowd 2025-08-31, triaged P3 (2025-09- 06); vendor acknowledged the behaviour but has not assigned a CVE or committed to a code fix. Kind Regards

Michael

A flaw was found in Moodle. Insufficient escaping of the username on the password reset page allowed a minor cross-site scripting (XSS) risk if an unauthenticated user was tricked into opening a crafted password reset link. The reporter states this did not affect authenticated user sessions; that disclaimer is reflected in the impact assessment here.

A flaw was found in Moodle. An incorrect capability check in the AI editor placement's "generate image" web service allowed a user to invoke that feature without holding the required capability. The advisory does not state the exact privilege level of an affected user; this draft assumes access is limited to users who already hold some content-editing role rather than a fully anonymous or lowest-privilege user.

A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses they do not have authorization to access.

A flaw was found in Moodle. User list filters did not respect user profile field visibility settings, allowing a manager to filter by a profile field they could not otherwise view on a user's profile, resulting in partial, inference-based information disclosure.

A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthorized requests on the victim's behalf. This flaw allows a remote attacker to set or overwrite student grades without authorization.

A flaw was found in Moodle. When enrolling a user into a course while selecting a group, a check that the selected group actually belonged to that course was missing, allowing a teacher to add users to groups in courses the teacher could not otherwise access.

A flaw was found in Moodle. An incorrect capability check in the AI editor placement's "generate image" web service allowed a user to invoke that feature without holding the required capability. The advisory does not state the exact privilege level of an affected user; this draft assumes access is limited to users who already hold some content-editing role rather than a fully anonymous or lowest-privilege user.

A flaw was found in Moodle. Insufficient escaping of the username on the password reset page allowed a minor cross-site scripting (XSS) risk if an unauthenticated user was tricked into opening a crafted password reset link. The reporter states this did not affect authenticated user sessions; that disclaimer is reflected in the impact assessment here.

A flaw was found in Moodle. The XML grade import functionality, which allows setting or overwriting of student grades, did not include the token required to prevent a cross-site request forgery (CSRF) risk, allowing an attacker to overwrite grades on behalf of a logged-in victim who visits a malicious page.

A flaw was found in Moodle. User list filters did not respect user profile field visibility settings, allowing a manager to filter by a profile field they could not otherwise view on a user's profile, resulting in partial, inference-based information disclosure.

A flaw was found in Moodle. Insufficient escaping in templates used to display forum posts resulted in a cross-site scripting (XSS) risk, allowing a stored script to execute in the browser of another user who views the affected forum post.

A flaw was found in Moodle. The manual enrolment management page did not correctly observe the disabled state of the manual enrolment plugin, allowing direct access to the page when the plugin was disabled and no longer linked from the UI. The relevant enrolment capability was still required to access the page, limiting the practical impact.

A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected application behavior.

A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores.

A flaw was found in Moodle. Missing capability checks made it possible for a low-privileged authenticated user to trigger grade penalty recalculation without holding the capability normally required to do so.

A flaw was found in Moodle. Insufficient escaping in templates used to display forum posts resulted in a cross-site scripting (XSS) risk, allowing a stored script to execute in the browser of another user who views the affected forum post.

A flaw was found in Moodle's report builder (corereportbuilder). Insufficient validation of the audience classname allowed arbitrary class instantiation. No exploitable gadget chain leading to a stronger impact (e.g. code execution or data disclosure) has been demonstrated; the flaw is treated here as instantiation of an arbitrary class with no confirmed further primitive.

A flaw was found in Moodle. The manual enrolment management page did not correctly observe the disabled state of the manual enrolment plugin, allowing direct access to the page when the plugin was disabled and no longer linked from the UI. The relevant enrolment capability was still required to access the page, limiting the practical impact.

A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course that they should not have permission to view. This issue leads to unauthorized information disclosure.

A flaw was found in Moodle's grade web service. An incorrect capability check allowed a student to access profile information of other students enrolled in the same course, which they would not otherwise have access to.

A flaw was found in Moodle. A SQL injection risk was identified in a question bank web service, allowing unsanitized input to reach a database query. The advisory does not state the exact capability required to call the affected web service function; this draft assumes it requires an elevated (teacher-level) role rather than being reachable by a basic authenticated user.

A flaw was found in Moodle. A SQL injection risk was identified in a question bank web service, allowing unsanitized input to reach a database query. The advisory does not state the exact capability required to call the affected web service function; this draft assumes it requires an elevated (teacher-level) role rather than being reachable by a basic authenticated user.

A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted destinations, leading to Server-Side Request Forgery (SSRF).

A flaw was found in Moodle's URL downloader. Incorrect handling of IPv4-mapped IPv6 addresses in the host-blocking logic allows an authenticated user to bypass some blocked-host restrictions, resulting in a server-side request forgery (SSRF) risk when the downloader fetches a crafted URL. No further impact beyond partial blocklist bypass has been demonstrated.