[ CVE-2026-102584 · Published 30 Sep 2026 ]

Vulnerability in moodle

CVSS 4.3 EPSS <1%Fix available

[ Description ]Official description

A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores.

[ Fixes ]Fixes and patches

Patch on git.moodle.orgVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References

git.moodle.org/gwPatch
access.redhat.com/security/cve/CVE-2026-102584Third Party Advisory
bugzilla.redhat.com/show_bug.cgiIssue TrackingThird Party Advisory
moodle.org/mod/forum/discuss.phpVendor Advisory