[ CVE-2026-102585 · Published 30 Sep 2026 ]

Vulnerability in moodle

CVSS 4.3 EPSS <1%1 agency advisoryFix available

[ Description ]Official description

A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses they do not have authorization to access.

[ Fixes ]Fixes and patches

Patch on git.moodle.orgVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ Advisories ]Government CERT advisories

BSI CERT-Bund30 Sep 2026WID-SEC-2026-3686

Moodle: Multiple vulnerabilities Translated from German
CVE-2026-102588CVE-2026-102585CVE-2026-102587+1 more CVEs

[ References ]References

git.moodle.org/gwPatch
access.redhat.com/security/cve/CVE-2026-102585Third Party Advisory
bugzilla.redhat.com/show_bug.cgiIssue TrackingThird Party Advisory
moodle.org/mod/forum/discuss.phpVendor Advisory

[ Description ]Official description

[ Fixes ]Fixes and patches

[ Advisories ]Government CERT advisories

Moodle: Multiple vulnerabilities Translated from German

[ References ]References