Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck
CVE-2026-119556Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Missing Authorization via core_grades_get_gradeitems
Medium 4.3
In plain English
A medium-severity missing authorization in moodle from Moodle Project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Official description
Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the core_grades_get_gradeitems web service that allows enrolled students to view hidden grade items. Authenticated course users can call the AJAX or mobile web service to list hidden grade item ids, names, and categories that the gradebook conceals from them.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Moodle Project | moodle | 5.3.05.2.0 – through 5.2.45.1.0 – through 5.1.85.0.0 – through 5.0.114.2.0 – through 4.5.15 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- https://github.com/moodle/moodle/blob/v5.3.0/public/grade/classes/external/get_gradeitems.php#L74-L80 technical-description
- https://abraxaslabs.tech/research/moodle-grades-gradeitems third-party-advisory
- https://github.com/moodle/moodle product
- VulnCheck Advisory: Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Missing Authorization via core_grades_get_gradeitems third-party-advisory