CVE-2026-102582: Moodle Authentication Bypass Vulnerability

CVE-2026-102582 Overview

A flaw in Moodle allows authorized users with enrolment permissions to bypass an administrator-disabled feature. The manual enrolment management page fails to verify whether the manual enrolment plugin is disabled before rendering. Users who navigate directly to the page URL can manage manual enrolments even after the feature has been turned off through the user interface. The issue is categorized under CWE-425: Direct Request (Forced Browsing).

Critical Impact
Users with existing enrolment permissions can manage manual enrolments after an administrator disables the plugin, undermining the intended administrative control.

Affected Products

Moodle (learning management system)
Distributions packaging Moodle, including Red Hat ecosystem builds tracked under Red Hat CVE-2026-102582 Advisory
Deployments referenced in the upstream Moodle Commit Log - MDL-88593

Discovery Timeline

2026-09-30 - CVE CVE-2026-102582 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-102582

Vulnerability Analysis

The vulnerability resides in Moodle's manual enrolment management page. The page renders its administrative interface without first checking whether the manual enrolment plugin is enabled in site configuration. An authenticated user with the appropriate enrolment capability can navigate directly to the management URL and interact with the interface. The user interface toggle that administrators use to disable the plugin does not translate into a server-side authorization check on the affected page. Exploitation requires an existing high-privilege role, which limits practical impact but still represents a broken enforcement of an administrator's configuration intent.

Root Cause

The root cause is a missing state check. The manual enrolment page enforces user permission checks but does not evaluate the plugin's enabled state before granting access. This gap between the UI-level control and the server-side authorization logic is characteristic of forced browsing weaknesses classified under CWE-425. See the upstream tracker in the Moodle Forum Discussion Thread and the Red Hat Bugzilla Report #2543636 for additional context.

Attack Vector

An authenticated user with enrolment permissions crafts or reuses the direct URL of the manual enrolment management page. The page responds normally despite the plugin being disabled through the administrative interface. The user then performs enrolment operations that the administrator intended to prevent. No unauthenticated network access, code execution, or memory corruption is involved.

No verified proof-of-concept code is available for this issue. Refer to the Moodle Commit Log - MDL-88593 for the upstream fix details.

Detection Methods for CVE-2026-102582

Indicators of Compromise

Web server access log entries showing HTTP requests to the Moodle manual enrolment management endpoint after the plugin has been disabled in site administration.
Audit log records showing manual enrolment changes performed by non-administrator accounts while the plugin is marked disabled.
Discrepancies between the plugin's disabled state in the admin UI and continued enrolment activity attributed to the manual method.

Detection Strategies

Correlate Moodle configuration changes that disable the manual enrolment plugin with subsequent activity on the manual enrolment management URL.
Alert when enrolment write operations occur through a plugin whose enabled flag is set to 0 in the mdl_config_plugins table.
Baseline expected administrative URL access patterns and flag direct navigations to enrolment management pages by non-administrator roles.

Monitoring Recommendations

Forward Moodle application logs and web server logs to a centralized logging platform for cross-correlation and long-term retention.
Monitor the Moodle event log (\core\event\user_enrolment_created, \core\event\user_enrolment_updated) for enrolments created by the manual plugin outside expected windows.
Review role assignments for the enrol/manual:enrol and related capabilities and reduce their scope where feasible.

How to Mitigate CVE-2026-102582

Immediate Actions Required

Apply the upstream Moodle patch referenced in Moodle Commit Log - MDL-88593 as soon as vendor-supported builds are available.
Audit which accounts hold the enrol/manual:enrol, enrol/manual:unenrol, and enrol/manual:manage capabilities and remove them from users who do not require them.
Review recent manual enrolment activity for enrolments created while the plugin was intended to be disabled.

Patch Information

The upstream fix is tracked as MDL-88593. Consult the Moodle Commit Log - MDL-88593 for the specific changes and the Red Hat CVE-2026-102582 Advisory for distribution-specific package updates. Apply the fixed version supplied by your Moodle distribution or the upstream project.

Workarounds

Restrict enrolment capabilities to a minimal set of trusted administrators until the patch is applied.
Use web server access controls to block direct requests to the manual enrolment management URL when the plugin is intended to remain disabled.
Increase monitoring of the Moodle event log for unexpected manual enrolment operations during the window before patching.

bash

# Example: block direct access to the manual enrolment management page at the web server layer
# Adjust the location path to match your Moodle install prefix
location ~* /enrol/manual/manage\.php$ {
    deny all;
    return 403;
}