Vulnerability · Published Sep 30, 2026 · Assigned by fedora
CVE-2026-102580Moodle: arbitrary class instantiation via report builder audience classname
Low 2.2
In plain English
A low-severity security flaw in moodle. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Severity (CVSS 3.1)2.2Low
Exploit odds (30 days)0.2%top 85.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected application behavior.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| moodle | 5.2.0 – before 5.2.25.1.0 – before 5.1.65.0.0 – before 5.0.90 – before 4.5.13 |
Weakness: CWE-470 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
References
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-89078
- https://access.redhat.com/security/cve/CVE-2026-102580 vdb-entry, x_refsource_REDHAT
- RHBZ#2543635 issue-tracking, x_refsource_REDHAT
- https://moodle.org/mod/forum/discuss.php?d=482498