CVE-2026-102580 Overview
CVE-2026-102580 is an unsafe reflection vulnerability in Moodle's Report Builder component. An authenticated attacker can supply an improperly validated audience class name, causing the application to instantiate arbitrary internal classes. This leads to the unauthorized creation of program objects and may produce unexpected application behavior.
The flaw is classified under CWE-470: Use of Externally-Controlled Input to Select Classes or Code, commonly referred to as unsafe reflection. Exploitation requires an authenticated session with high privileges, which limits the practical attack surface.
Critical Impact
Authenticated attackers with high privileges can trigger arbitrary class instantiation in the Report Builder, potentially altering application state or behavior.
Affected Products
- Moodle (versions containing the Report Builder audience handling code prior to the MDL-89078 fix)
- Red Hat distributions packaging affected Moodle builds (see Red Hat advisory)
- Downstream Moodle deployments that have not applied upstream patches
Discovery Timeline
- 2026-09-30 - CVE-2026-102580 published to the National Vulnerability Database (NVD)
- 2026-09-30 - Last updated in NVD database
Technical Details for CVE-2026-102580
Vulnerability Analysis
The Report Builder component in Moodle accepts an audience class name as input when constructing report audience objects. The component fails to validate that the supplied class name belongs to an allow-list of expected audience classes.
Because the class name is treated as trusted input, Moodle instantiates whatever class the attacker names. This is a textbook unsafe reflection pattern, tracked as CWE-470. The consequence is the creation of internal program objects that were never intended to be reachable through the Report Builder workflow.
Exploitation requires network access, high privileges, and high attack complexity. Impact is limited to integrity of application state; confidentiality and availability are not directly affected according to the published metrics.
Root Cause
The root cause is missing input validation on the audience class name parameter passed to the Report Builder. The code performs dynamic class instantiation without confirming that the target class inherits from the expected audience base class or appears on an approved list.
See the Moodle Commit Log MDL-89078 for the upstream fix reference and the Red Hat CVE-2026-102580 Advisory for distribution-level tracking.
Attack Vector
The attack is network-reachable through the Moodle web interface. An authenticated user with sufficient privileges to interact with the Report Builder submits a crafted request containing an unexpected audience class name. Moodle then instantiates that class server-side.
No verified public exploit code is available. Technical discussion is limited to the Moodle Forum Discussion #482498 and the Bugzilla Red Hat Report #2543635.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-102580
Indicators of Compromise
- Report Builder audit entries referencing audience class names that are not part of the standard Moodle audience class set.
- HTTP POST requests to Report Builder endpoints containing unexpected fully qualified PHP class names in audience parameters.
- PHP error logs showing autoload attempts or instantiation failures for non-audience classes triggered from Report Builder code paths.
Detection Strategies
- Enable verbose logging on Moodle Report Builder actions and correlate audience class values against a known-good allow-list.
- Inspect web server access logs for authenticated sessions submitting anomalous parameter values to /reportbuilder/ endpoints.
- Alert on unexpected PHP class instantiations originating from the Report Builder subsystem via application-level tracing.
Monitoring Recommendations
- Monitor privileged Moodle accounts for unusual Report Builder activity, especially audience configuration changes.
- Track error rates and stack traces from Report Builder code paths to surface failed exploitation attempts.
- Forward Moodle and PHP-FPM logs to a centralized analytics platform for retention and correlation.
How to Mitigate CVE-2026-102580
Immediate Actions Required
- Apply the upstream Moodle patch associated with MDL-89078 as soon as a fixed release is available for your branch.
- Restrict Report Builder access to trusted administrative users and audit existing role assignments.
- Review recent Report Builder audience configurations for unfamiliar class names and remove any that are not recognized.
Patch Information
Refer to the Moodle Commit Log MDL-89078 for the upstream code change and the Red Hat CVE-2026-102580 Advisory for distribution-specific package updates. Apply the fix through your standard Moodle upgrade process or your operating system package manager.
Workarounds
- Temporarily revoke Report Builder capabilities from non-essential administrative roles until the patch is deployed.
- Place a web application firewall rule in front of Report Builder endpoints to reject requests whose audience class parameter does not match the expected allow-list.
- Increase monitoring on the affected endpoints and review logs daily until remediation is complete.
# Example: identify Moodle version prior to patching
php /path/to/moodle/admin/cli/checks.php --list
grep -R "MDL-89078" /path/to/moodle/ || echo "Patch reference not found - upgrade required"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
