CVE-2026-102585: Moodle Auth Bypass Vulnerability

CVE-2026-102585 Overview

A broken access control flaw exists in Moodle's course enrollment workflow. When enrolling a user into a course and assigning them to a group, the application fails to verify that the selected group actually belongs to the target course. An authenticated user with teacher privileges can exploit this flaw to add users to groups within courses they do not have authorization to access. The issue is tracked under Moodle's internal identifier MDL-88538 and is classified under CWE-842: Placement of User into Incorrect Group.

Critical Impact

Authenticated teachers can manipulate group membership in unauthorized courses, leading to unintended data exposure and cross-course integrity issues.

Affected Products

• Moodle Learning Management System (specific affected versions to be confirmed via vendor advisory)
• Red Hat distributions packaging Moodle (see Red Hat CVE Report CVE-2026-102585)
• Installations tracking upstream fix commits for MDL-88538

Discovery Timeline

• 2026-09-30 - CVE CVE-2026-102585 published to NVD
• 2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-102585

Vulnerability Analysis

Moodle's group enrollment logic accepts a groupid parameter alongside a courseid parameter during user enrollment operations. The server-side handler enrolls the user and assigns the group without confirming that the referenced group belongs to the referenced course. As a result, a teacher acting within a course they legitimately manage can supply a groupid that maps to a completely different course. The enrollment succeeds, placing an arbitrary user into an unrelated group.

The consequence is a cross-course authorization boundary bypass. Group membership in Moodle controls visibility of assignments, forum posts, grades, and restricted resources. Injecting users into unauthorized groups can leak protected coursework or disrupt group-based grading workflows. The impact scope stays limited because the actor must already hold teacher-level credentials in at least one course.

Root Cause

The root cause is missing referential validation between the course and group entities during enrollment. The vulnerable code path trusts the client-supplied groupid without cross-checking the group's parent course against the enrolling teacher's authorization scope. This is a classic [CWE-842] broken access control pattern where an object identifier is accepted without ownership verification.

Attack Vector

The attack requires network access to the Moodle instance and authenticated teacher privileges in any course. An attacker submits an enrollment request specifying a target userid, their own courseid, and a groupid belonging to a course they do not administer. The server processes the request and modifies group membership in the foreign course. See the Moodle Commit Search for MDL-88538 for the upstream fix and the Moodle Forum Discussion #482503 for community context.

Detection Methods for CVE-2026-102585

Indicators of Compromise

• Group membership changes affecting users who are not enrolled through the standard course workflow of the acting teacher.
• Web server access logs showing repeated POST requests to Moodle enrollment endpoints with groupid values that do not match the associated courseid.
• Audit log entries where the userid of the acting teacher does not have an editing role in the course containing the modified group.

Detection Strategies

• Query the Moodle database to reconcile groups.courseid against enrollment events and flag mismatches where the acting user lacks the moodle/course:managegroups capability.
• Correlate Moodle mdl_logstore_standard_log entries for the group_member_added event with the acting user's role assignments in the target course.
• Deploy web application firewall rules that inspect enrollment API parameters and reject requests where groupid metadata does not align with the submitted courseid.

Monitoring Recommendations

• Forward Moodle application logs and web server logs to a centralized SIEM for retention and correlation.
• Alert on high-volume group membership modifications originating from a single teacher account within short time windows.
• Review privileged role assignments quarterly to ensure teacher accounts follow least-privilege scoping.

How to Mitigate CVE-2026-102585

Immediate Actions Required

• Apply the upstream Moodle patch associated with MDL-88538 as soon as it is available for your release branch.
• Audit current group memberships to identify users placed into groups outside the enrolling teacher's authorized courses.
• Restrict the teacher role capability set to the minimum required for legitimate course management.

Patch Information

The fix is tracked upstream under MDL-88538. Administrators should monitor the Moodle Commit Search for MDL-88538 and the Red Hat Bug Report #2543639 for downstream patch availability. Distribution vendors are expected to publish updated packages that enforce course-to-group referential checks during enrollment.

Workarounds

• Reduce the number of accounts holding teacher-equivalent roles until the patch is applied.
• Enable database-level triggers or scheduled reconciliation jobs that detect and reverse cross-course group assignments.
• Increase audit log verbosity for enrollment and group management events and review them on a daily cadence until remediation is complete.

# Configuration example: reconcile cross-course group memberships (read-only audit query)
mysql -u moodleuser -p moodle -e "\
  SELECT gm.userid, gm.groupid, g.courseid AS group_course, e.courseid AS enrol_course \
  FROM mdl_groups_members gm \
  JOIN mdl_groups g ON g.id = gm.groupid \
  JOIN mdl_user_enrolments ue ON ue.userid = gm.userid \
  JOIN mdl_enrol e ON e.id = ue.enrolid \
  WHERE g.courseid <> e.courseid;"