CVE-2026-102587

A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure by inferring hidden user data.

CVSS v3 2.7 LOW

2.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-87518	Patch
https://access.redhat.com/security/cve/CVE-2026-102587	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2543642	Issue Tracking Third Party Advisory
https://moodle.org/mod/forum/discuss.php?d=482506	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:moodle:moodle::::::::
	cpe:2.3:a:moodle:moodle::::::::
	cpe:2.3:a:moodle:moodle::::::::
	cpe:2.3:a:moodle:moodle::::::::

History

01 Oct 2026, 14:29

Type	Values Removed	Values Added
References	~~() http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-87518 -~~	() http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-87518 - Patch
References	~~() https://access.redhat.com/security/cve/CVE-2026-102587 -~~	() https://access.redhat.com/security/cve/CVE-2026-102587 - Third Party Advisory
References	~~() https://bugzilla.redhat.com/show_bug.cgi?id=2543642 -~~	() https://bugzilla.redhat.com/show_bug.cgi?id=2543642 - Issue Tracking, Third Party Advisory
References	~~() https://moodle.org/mod/forum/discuss.php?d=482506 -~~	() https://moodle.org/mod/forum/discuss.php?d=482506 - Vendor Advisory
CPE		cpe:2.3:a:moodle:moodle::::::::
First Time		Moodle Moodle moodle

30 Sep 2026, 09:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-30 09:17

Updated : 2026-10-01 14:29

NVD link : CVE-2026-102587

Mitre link : CVE-2026-102587

CVE.ORG link : CVE-2026-102587

JSON object : View

Products Affected

moodle

moodle

CWE

CWE-204

Observable Response Discrepancy

{"id": "CVE-2026-102587", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-102587", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-30T13:56:25.921374Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "patrick@puiterwijk.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.2}]}, "affected": [{"source": "patrick@puiterwijk.org", "affectedData": [{"versions": [{"status": "affected", "version": "5.2.0", "lessThan": "5.2.2", "versionType": "semver"}, {"status": "affected", "version": "5.1.0", "lessThan": "5.1.6", "versionType": "semver"}, {"status": "affected", "version": "5.0.0", "lessThan": "5.0.9", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "4.5.13", "versionType": "semver"}], "packageName": "moodle", "collectionURL": "https://git.moodle.org", "defaultStatus": "unaffected"}]}], "published": "2026-09-30T09:17:16.023", "references": [{"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-87518", "tags": ["Patch"], "source": "patrick@puiterwijk.org"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-102587", "tags": ["Third Party Advisory"], "source": "patrick@puiterwijk.org"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543642", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "patrick@puiterwijk.org"}, {"url": "https://moodle.org/mod/forum/discuss.php?d=482506", "tags": ["Vendor Advisory"], "source": "patrick@puiterwijk.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "patrick@puiterwijk.org", "description": [{"lang": "en", "value": "CWE-204"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure by inferring hidden user data."}], "lastModified": "2026-10-01T14:29:38.930", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "99FF93A9-D754-4DE4-8D1B-B4C324CDA91A", "versionEndExcluding": "4.5.13"}, {"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "11BA4A97-DFEA-4813-B107-4BA4C0BD78DB", "versionEndExcluding": "5.0.9", "versionStartIncluding": "5.0.0"}, {"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "37F95B02-166C-45BA-B537-21CB5084001F", "versionEndExcluding": "5.1.6", "versionStartIncluding": "5.1.0"}, {"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EFDDCBAE-2DFF-45D6-A90A-2A9AC1743722", "versionEndExcluding": "5.2.2", "versionStartIncluding": "5.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "patrick@puiterwijk.org"}