CVE-2026-102584: Moodle Privilege Escalation Vulnerability

CVE-2026-102584 Overview

A missing capability check in Moodle allows a low-privileged authenticated user to trigger recalculation of grade penalties without the required permissions. The flaw enables unauthorized modification of grade penalty records, which can alter student assessment scores. The weakness is tracked as [CWE-425] Direct Request (Forced Browsing) and stems from insufficient authorization enforcement on a grade-related endpoint. Exploitation requires only an authenticated account on the target Moodle instance and no user interaction from a victim.

Critical Impact
Any authenticated Moodle user can recalculate and modify grade penalty records, undermining the integrity of student assessment data.

Affected Products

Moodle Learning Management System (versions addressed by fix MDL-88585)
Red Hat distributions packaging affected Moodle releases
Any downstream deployment tracking the affected Moodle branches

Discovery Timeline

2026-09-30 - CVE CVE-2026-102584 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-102584

Vulnerability Analysis

Moodle exposes an endpoint that recalculates grade penalties applied to student submissions. This endpoint fails to enforce a capability check confirming the caller holds the permission required to modify grades. As a result, any authenticated user, including students, can invoke the recalculation logic and change stored grade penalty records. The impact is limited to integrity of assessment data; confidentiality and availability are not directly affected. Attackers exploit the flaw over the network by sending a crafted request to the vulnerable handler while logged in with any valid account.

Root Cause

The root cause is a missing call to Moodle's capability API before executing the grade penalty recalculation. Moodle relies on has_capability() and require_capability() checks to gate privileged actions. When these checks are omitted on a state-changing endpoint, authorization defaults to "any authenticated user," which contradicts the intended permission model. The commit referenced by MDL-88585 adds the required capability enforcement.

Attack Vector

Exploitation is network-based and requires a low-privileged authenticated session. The attacker issues a direct request to the grade penalty recalculation endpoint, bypassing role-based restrictions that would normally be enforced on grade modification workflows. No social engineering or victim interaction is required. See the Moodle Commit Reference MDL-88585 and Red Hat CVE-2026-102584 Advisory for technical details.

No public proof-of-concept code has been released. The vulnerability is described in prose only per verified sources.

Detection Methods for CVE-2026-102584

Indicators of Compromise

Unexpected changes to grade penalty records in the mdl_grade_grades or related tables not attributable to a teacher or administrator.
Web server access logs showing requests to grade penalty recalculation endpoints originating from student-role accounts.
Audit log entries showing grade modifications where the actor lacks the moodle/grade:edit capability.

Detection Strategies

Enable Moodle event logging and monitor \core\event\grade_updated and related grade events for actors without grading roles.
Correlate HTTP request logs with authenticated session role data to identify unauthorized invocations of grade-modifying endpoints.
Baseline normal grade recalculation activity per instructor and alert on outliers or off-hours activity.

Monitoring Recommendations

Forward Moodle application and web server logs to a centralized log platform for continuous review.
Alert on any grade record modification performed by user accounts holding only student-level roles.
Review the Moodle Forum Discussion #482502 for community-reported detection signals.

How to Mitigate CVE-2026-102584

Immediate Actions Required

Apply the upstream Moodle patch referenced by MDL-88585 as soon as it is available for your branch.
Audit grade records for unauthorized penalty changes since the vulnerable code was deployed.
Restrict access to the Moodle instance to trusted networks where feasible until patching is complete.

Patch Information

The fix is tracked in Moodle issue MDL-88585 and adds the missing capability check to the grade penalty recalculation flow. Consult the Moodle Commit Reference MDL-88585, the Red Hat CVE-2026-102584 Advisory, and Red Hat Bug Report #2543637 for build-specific fixed versions and distribution updates.

Workarounds

Temporarily disable grade penalty features in course settings if the patch cannot be applied immediately.
Restrict authenticated access to trusted user populations using network-level controls or single sign-on policies.
Increase logging verbosity on grade-related endpoints to detect abuse until the patch is deployed.

bash

# Configuration example: back up grade tables before applying the patch
mysqldump -u moodleuser -p moodle mdl_grade_grades mdl_grade_items > moodle_grades_backup.sql