CVE-2026-102587: Moodle Information Disclosure Vulnerability

CVE-2026-102587 Overview

A flaw in Moodle allows authorized users with manager privileges to infer hidden user profile data through list filters. User list filters do not enforce visibility restrictions on user profile fields. A manager can filter user lists using profile attributes they are not permitted to view directly. The filter results reveal whether specific attribute values match, disclosing information the manager should not access. This vulnerability is classified as an Observable Response Discrepancy [CWE-204].

Critical Impact
A manager-level user can enumerate restricted profile field values across the Moodle user base by observing filter response differences, resulting in unauthorized information disclosure.

Affected Products

Moodle Learning Management System
Red Hat distributions packaging Moodle (see Red Hat advisory)
Moodle instances tracked under issue MDL-87518

Discovery Timeline

2026-09-30 - CVE CVE-2026-102587 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-102587

Vulnerability Analysis

Moodle exposes user profile fields with configurable visibility controls. Site administrators can restrict which roles view specific fields such as identifiers, department, or contact data. The user list filtering component queries these fields without applying the same visibility policy that governs direct field display.

A user with manager privileges submits filter expressions targeting restricted attributes. The backend evaluates the filter and returns matching user rows. By iterating filter values, the manager infers the underlying attribute contents for any user in the result set. The visibility model breaks because the enforcement gate exists on the render path but not on the query path.

The issue affects confidentiality only. Integrity and availability remain intact. Exploitation requires an authenticated account with manager-level privileges, which limits the attacker population to trusted insiders or accounts obtained through credential compromise.

Root Cause

The root cause is missing access control checks in the user list filter logic. Moodle enforces field-level visibility when rendering profile pages but not when constructing filter queries. This inconsistency lets managers observe query response differences that leak restricted values, matching the [CWE-204] Observable Response Discrepancy pattern.

Attack Vector

An attacker authenticates to Moodle as a manager. The attacker navigates to the user management interface and constructs filter queries against restricted profile fields. By comparing result counts across successive filter values, the attacker reconstructs hidden attribute data. See the Moodle Commit MDL-87518 and the Moodle Forum Discussion #482506 for technical details.

No verified exploitation code is publicly available. The vulnerability manifests through legitimate application functionality abused against the intended visibility policy.

Detection Methods for CVE-2026-102587

Indicators of Compromise

Repeated user list filter queries from a single manager account targeting profile attribute fields marked as restricted.
High-volume enumeration patterns against the Moodle user administration endpoints within short time windows.
Anomalous filter parameter variation against the same field across sequential requests, indicating value guessing.

Detection Strategies

Enable Moodle application logging for user list queries and record the filter parameters submitted by manager accounts.
Correlate filter query volume per user account against a baseline of normal administrative activity.
Alert on filter operations that reference profile fields configured with restricted visibility policies.

Monitoring Recommendations

Forward Moodle web server and application logs to a central SIEM for retention and analysis.
Track privileged role assignments and review manager account provisioning on a scheduled cadence.
Monitor authentication events for manager accounts and flag logins from unexpected geolocations or devices.

How to Mitigate CVE-2026-102587

Immediate Actions Required

Apply the Moodle security update associated with issue MDL-87518 once available for your release track.
Audit accounts holding the manager role and revoke privileges from users who do not require them.
Review custom profile field visibility settings and confirm they align with data handling policies.

Patch Information

The upstream fix is tracked in the Moodle source tree under MDL-87518. Refer to the Moodle Commit MDL-87518 for the code changes and to Red Hat CVE-2026-102587 and Red Hat Bugzilla #2543642 for distribution package tracking.

Workarounds

Restrict manager role assignments to a minimal set of trusted administrators until patches are deployed.
Remove sensitive attributes from custom user profile fields where feasible to reduce the disclosure surface.
Disable or restrict access to the user list filtering interface via web server access controls where operationally acceptable.

bash

# Configuration example: restrict access to Moodle user admin endpoints at the web tier
# Apache example - limit /admin/user.php to a trusted IP range
<Location "/admin/user.php">
    Require ip 10.0.0.0/24
</Location>