Vulnerability · Published Sep 30, 2026 · Assigned by fedora
CVE-2026-102587Moodle: user list filters bypass profile field visibility
Low 2.7
In plain English
A low-severity security flaw in moodle. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Severity (CVSS 3.1)2.7Low
Exploit odds (30 days)0.2%top 85.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure by inferring hidden user data.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| moodle | 5.2.0 – before 5.2.25.1.0 – before 5.1.65.0.0 – before 5.0.90 – before 4.5.13 |
Weakness: CWE-204 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
References
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-87518
- https://access.redhat.com/security/cve/CVE-2026-102587 vdb-entry, x_refsource_REDHAT
- RHBZ#2543642 issue-tracking, x_refsource_REDHAT
- https://moodle.org/mod/forum/discuss.php?d=482506