Medium · published September 30, 2026
A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores.
| Product | Versions | Fixed in |
|---|---|---|
| moodle/moodle | ≥ 5.0.0, < 5.0.9 | 5.0.9 |
| moodle/moodle | ≥ 5.1.0, < 5.1.6 | 5.1.6 |
| moodle/moodle | ≥ 5.2.0, < 5.2.2 | 5.2.2 |