CVE-2026-102584

Katalog CVE

CVSS 4.3 · Medium EPSS 0,20%

Kerentanan Direct Request ('Forced Browsing') pada moodle. Skor CVSS 3.1 4.3 (Medium) menurut puiterwijk.org.

Deskripsi (NVD)

A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores.

Rincian

Terbit di NVD

30 September 2026

Terakhir diubah

1 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber puiterwijk.org
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-425: Direct Request ('Forced Browsing')

EPSS (30 hari)

0,20% peluang dieksploitasi; lebih tinggi dari 9,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://moodle.org/mod/forum/discuss.php?d=482502 advisory vendor
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88585 patch
• https://access.redhat.com/security/cve/CVE-2026-102584 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2543637 issue tracking · advisory pihak ketiga