CVE-2026-102579: Moodle Information Disclosure Vulnerability

CVE-2026-102579 Overview

A flaw in Moodle allows authenticated students to access profile information of other students enrolled in the same course. The vulnerability stems from an incorrect capability check in the grade web service. Attackers with valid student credentials can retrieve profile data they should not have permission to view. This leads to unauthorized information disclosure of user data within shared course enrollments. The issue is categorized under [CWE-359] Exposure of Private Personal Information to an Unauthorized Actor.

Critical Impact
Authenticated students can view profile information of other course participants through the grade web service, violating expected access boundaries in Moodle's course enrollment model.

Affected Products

Moodle Learning Management System (specific affected versions listed in the Moodle Forum Discussion #482497)
Red Hat distributions of Moodle (see Red Hat CVE-2026-102579 Advisory)

Discovery Timeline

2026-09-30 - CVE CVE-2026-102579 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-102579

Vulnerability Analysis

The vulnerability resides in Moodle's grade web service endpoint. The service performs an incorrect capability check when returning grade-related data to authenticated users. As a result, a student querying the service can receive profile information belonging to other students enrolled in the same course. This exposes user data intended to be restricted based on Moodle's role and capability model. The impact is limited to information disclosure. The flaw does not permit modification of data or affect system availability.

Root Cause

The root cause is an authorization logic error in the grade web service handler. The capability check does not correctly validate whether the requesting user should view the target user's profile fields. Moodle relies on capabilities such as moodle/user:viewdetails and moodle/course:viewparticipants to gate access to profile data. The incorrect implementation allows the request to proceed and return protected fields to unprivileged accounts. Fix commits are tracked under MDL-89381 and referenced in the Moodle Commit for MDL-89381.

Attack Vector

Exploitation requires an authenticated student account with enrollment in a shared course. The attacker issues a request to the vulnerable grade web service endpoint over the network. No user interaction from the victim is required. The service returns profile details of co-enrolled students that would otherwise be hidden by Moodle's participant visibility settings. The vulnerability is described in prose only; no verified public exploit code is available. Refer to Bugzilla Report #2543633 for additional technical context.

Detection Methods for CVE-2026-102579

Indicators of Compromise

Unusual volume of requests to Moodle web service endpoints related to grades from a single authenticated student account.
Web service tokens issued to student roles being used to query user profile fields at scale.
Log entries in Moodle's mdl_logstore_standard_log table showing repeated user_profile_viewed or grade export events across many users in a course.

Detection Strategies

Review Moodle web service access logs for grade-related function calls originating from non-teacher role accounts.
Correlate web service token usage with the calling account's role and expected access scope.
Baseline normal grade web service query rates per user and alert on outliers.

Monitoring Recommendations

Enable Moodle event logging for web service calls and forward logs to a centralized SIEM.
Monitor for token creation events on student accounts, which is uncommon in typical deployments.
Track HTTP requests to /webservice/rest/server.php with grade-related wsfunction parameters.

How to Mitigate CVE-2026-102579

Immediate Actions Required

Apply the Moodle upstream fix associated with MDL-89381 as soon as it is available for your version.
Audit issued web service tokens and revoke any tokens not required for operational use.
Restrict web service access to trusted roles and disable the mobile or external web services if not in use.

Patch Information

The fix is tracked in the Moodle project under issue MDL-89381. Commits are searchable via the Moodle Commit for MDL-89381. Distribution-specific patches are tracked in the Red Hat CVE-2026-102579 Advisory and Bugzilla Report #2543633. Administrators should upgrade to the fixed Moodle release identified in the vendor advisory for their branch.

Workarounds

Disable the grade-related external web service functions in Site administration until the patch is applied.
Remove the webservice/rest:use and grade export capabilities from the authenticated student role.
Set course participant visibility to restrict profile field exposure through Site administration settings.

bash

# Configuration example: disable REST protocol web services temporarily
# In Moodle: Site administration > Server > Web services > Manage protocols
# Uncheck the REST protocol, or via CLI adjust config:
php admin/cli/cfg.php --name=webserviceprotocols --set=""