CVE-2026-102583

A flaw was found in Moodle. An incorrect capability check in the artificial intelligence (AI) editor placement's image generation web service allows an authenticated user to invoke the feature without holding the required capability. This flaw permits unauthorized users to access and utilize the AI image generation functionality.

CVSS v3 2.7 LOW

2.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88587	Patch
https://access.redhat.com/security/cve/CVE-2026-102583	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2543640	Issue Tracking Third Party Advisory
https://moodle.org/mod/forum/discuss.php?d=482501	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:moodle:moodle::::::::
	cpe:2.3:a:moodle:moodle::::::::
	cpe:2.3:a:moodle:moodle::::::::
	cpe:2.3:a:moodle:moodle::::::::

History

01 Oct 2026, 15:15

Type	Values Removed	Values Added
First Time		Moodle Moodle moodle
CPE		cpe:2.3:a:moodle:moodle::::::::
References	~~() http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88587 -~~	() http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88587 - Patch
References	~~() https://access.redhat.com/security/cve/CVE-2026-102583 -~~	() https://access.redhat.com/security/cve/CVE-2026-102583 - Third Party Advisory
References	~~() https://bugzilla.redhat.com/show_bug.cgi?id=2543640 -~~	() https://bugzilla.redhat.com/show_bug.cgi?id=2543640 - Issue Tracking, Third Party Advisory
References	~~() https://moodle.org/mod/forum/discuss.php?d=482501 -~~	() https://moodle.org/mod/forum/discuss.php?d=482501 - Vendor Advisory

30 Sep 2026, 09:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-30 09:17

Updated : 2026-10-01 15:15

NVD link : CVE-2026-102583

Mitre link : CVE-2026-102583

CVE.ORG link : CVE-2026-102583

JSON object : View

Products Affected

moodle

moodle

CWE

CWE-425

Direct Request ('Forced Browsing')

{"id": "CVE-2026-102583", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-102583", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-30T14:33:20.498442Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "patrick@puiterwijk.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.2}]}, "affected": [{"source": "patrick@puiterwijk.org", "affectedData": [{"versions": [{"status": "affected", "version": "5.2.0", "lessThan": "5.2.2", "versionType": "semver"}, {"status": "affected", "version": "5.1.0", "lessThan": "5.1.6", "versionType": "semver"}, {"status": "affected", "version": "5.0.0", "lessThan": "5.0.9", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "4.5.13", "versionType": "semver"}], "packageName": "moodle", "collectionURL": "https://git.moodle.org", "defaultStatus": "unaffected"}]}], "published": "2026-09-30T09:17:15.493", "references": [{"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88587", "tags": ["Patch"], "source": "patrick@puiterwijk.org"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-102583", "tags": ["Third Party Advisory"], "source": "patrick@puiterwijk.org"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543640", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "patrick@puiterwijk.org"}, {"url": "https://moodle.org/mod/forum/discuss.php?d=482501", "tags": ["Vendor Advisory"], "source": "patrick@puiterwijk.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "patrick@puiterwijk.org", "description": [{"lang": "en", "value": "CWE-425"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Moodle. An incorrect capability check in the artificial intelligence (AI) editor placement's image generation web service allows an authenticated user to invoke the feature without holding the required capability. This flaw permits unauthorized users to access and utilize the AI image generation functionality."}], "lastModified": "2026-10-01T15:15:21.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "99FF93A9-D754-4DE4-8D1B-B4C324CDA91A", "versionEndExcluding": "4.5.13"}, {"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "11BA4A97-DFEA-4813-B107-4BA4C0BD78DB", "versionEndExcluding": "5.0.9", "versionStartIncluding": "5.0.0"}, {"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "37F95B02-166C-45BA-B537-21CB5084001F", "versionEndExcluding": "5.1.6", "versionStartIncluding": "5.1.0"}, {"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EFDDCBAE-2DFF-45D6-A90A-2A9AC1743722", "versionEndExcluding": "5.2.2", "versionStartIncluding": "5.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "patrick@puiterwijk.org"}