[ CVE-2026-102587 · Published 30 Sep 2026 ]

Vulnerability in moodle

CVSS 2.7 EPSS <1%1 agency advisoryFix available

[ Description ]Official description

A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure by inferring hidden user data.

[ Fixes ]Fixes and patches

Patch on git.moodle.orgVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ Advisories ]Government CERT advisories

BSI CERT-Bund30 Sep 2026WID-SEC-2026-3686

Moodle: Multiple vulnerabilities Translated from German
CVE-2026-102588CVE-2026-102585CVE-2026-102587+1 more CVEs

[ References ]References

git.moodle.org/gwPatch
access.redhat.com/security/cve/CVE-2026-102587Third Party Advisory
bugzilla.redhat.com/show_bug.cgiIssue TrackingThird Party Advisory
moodle.org/mod/forum/discuss.phpVendor Advisory

[ Description ]Official description

[ Fixes ]Fixes and patches

[ Advisories ]Government CERT advisories

Moodle: Multiple vulnerabilities Translated from German

[ References ]References