CVE-2026-102587CWE-204

CVE-2026-102587

Low · published September 30, 2026

CVSS v3.1
2.7
EPSS
0%
Percentile
14.1
In the wild
Unconfirmed
What it is

A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure by inferring hidden user data.

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00238 · 14.1th percentile
Weakness
CWE-204 · Observable Response Discrepancy
Published
2026-09-30T13:17Z
Affected products (4)
ProductVersionsFixed in
moodle/moodle< 4.5.134.5.13
moodle/moodle≥ 5.0.0, < 5.0.95.0.9
moodle/moodle≥ 5.1.0, < 5.1.65.1.6
moodle/moodle≥ 5.2.0, < 5.2.25.2.2
References (4)
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-87518 · [email protected]https://access.redhat.com/security/cve/CVE-2026-102587 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2543642 · [email protected]https://moodle.org/mod/forum/discuss.php?d=482506 · [email protected]
EPSS history
Timeline
  • 01 OCT 03:44Z
    EPSS moved — → 0%
    epss
  • 30 SEP 08:36Z
    Moodle: user list filters bypass profile field visibility
    cvelistv5