Vulnerability · Published Sep 30, 2026 · Assigned by fedora
CVE-2026-102582Moodle: manual enrolment page accessible when plugin disabled
Low 2.2
In plain English
A low-severity security flaw in moodle. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Severity (CVSS 3.1)2.2Low
Exploit odds (30 days)0.2%top 90.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A flaw was found in Moodle. The manual enrolment management page did not properly check whether the manual enrolment plugin was disabled, allowing users with enrolment permissions to access the page directly by navigating to its URL. Consequently, an authorized user could manage manual enrolments even after an administrator disabled the feature in the user interface.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| moodle | 5.2.0 – before 5.2.25.1.0 – before 5.1.65.0.0 – before 5.0.90 – before 4.5.13 |
Weakness: CWE-425 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
References
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88593
- https://access.redhat.com/security/cve/CVE-2026-102582 vdb-entry, x_refsource_REDHAT
- RHBZ#2543636 issue-tracking, x_refsource_REDHAT
- https://moodle.org/mod/forum/discuss.php?d=482500