Zetlyn
GitHubGet started

A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade pe…

cve CVE-2026-102584 2 sources, 2 claims · Watch

NVD writes:
A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores. the claim
Severity
medium GitHub advisories
MEDIUM NVD
CVSS
4.3 GitHub advisories
4.3 NVD
Fixed in
5.2.2, 5.1.6, 5.0.9 NVD
CWE
CWE-425 GitHub advisories
CWE-425 NVD

How far exploitation has got

  1. No public code known
  2. Proof of concept
  3. Proof of concept, verified
  4. A Metasploit module
  5. Exploited in the wild
  6. Used in ransomware campaigns

Timeline

2026-09-30first spoke of it: A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated...GitHub advisories
2026-09-30first spoke of it: A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores.NVD

A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores.

What it is to other things

affectsmoodle/moodle
NVD
made_bymoodle
NVD
Every value, with what each source said and its receipt
PropertySourceSaidMeans here
Automatable
automatable
NVDno
At least one of those steps needs a person.
receipt
Source
NVD
Its words
no
Read by
field:cve.metrics.ssvcV203[].ssvcData.options[].automatable
Said since
2026-10-06 12:31 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:31 UTCno
2026-10-02 12:00 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://git.moodle.org",
            "defaultStatus": "unaffected",
            "packageName": "moodle",
            "versions": [
              {
                "lessThan": "5.2.2",
                "status": "affected",
                "version": "5.2.0",
                "versionType": "semver"
              },
              {
                "lessThan": "5.1.6",
                "status": "affected",
                "version": "5.1.0",
                "versionType": "semver"
              },
              {
                "lessThan": "5.0.9",
                "status": "affected",
                "version": "5.0.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "patrick@puiterwijk.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "11BA4A97-DFEA-4813-B107-4BA4C0BD78DB",
                "versionEndExcluding": "5.0.9",
                "versionStartIncluding": "5.0.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "37F95B02-166C-45BA-B537-21CB5084001F",
                "versionEndExcluding": "5.1.6",
                "versionStartIncluding": "5.1.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "EFDDCBAE-2DFF-45D6-A90A-2A9AC1743722",
                "versionEndExcluding": "5.2.2",
                "versionStartIncluding": "5.2.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores."
      }
    ],
    "id": "CVE-2026-102584",
    "lastModified": "2026-10-01T14:48:32.280",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 1.4,
          "source": "patrick@puiterwijk.org",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-102584",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-30T13:57:03.802504Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-30T09:17:15.630",
    "references": [
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Patch"
        ],
        "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88585"
      },
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://access.redhat.com/security/cve/CVE-2026-102584"
      },
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Issue Tracking",
          "Third Party Advisory"
        ],
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543637"
      },
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://moodle.org/mod/forum/discuss.php?d=482502"
      }
    ],
    "sourceIdentifier": "patrick@puiterwijk.org",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-425"
          }
        ],
        "source": "patrick@puiterwijk.org",
        "type": "Secondary"
      }
    ]
  }
}
—
CVSS
cvss
GitHub advisories4.3
receipt
Source
GitHub advisories
Its words
4.3
Read by
field:cvss.score
Said since
2026-10-02 11:59 UTC
Last answered
2026-10-06 13:46 UTC
Original
open at the source
What the source handed over
{
  "credits": [],
  "cve_id": "CVE-2026-102584",
  "cvss": {
    "score": 4.3,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 4.3,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
    },
    "cvss_v4": {
      "score": 0.0,
      "vector_string": null
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-425",
      "name": "Direct Request ('Forced Browsing')"
    }
  ],
  "description": "A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores.",
  "epss": {
    "percentage": 0.00196,
    "percentile": 0.08362
  },
  "ghsa_id": "GHSA-fqcg-5c9f-c55v",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-fqcg-5c9f-c55v",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-fqcg-5c9f-c55v"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-102584"
    }
  ],
  "nvd_published_at": "2026-09-30T09:17:15Z",
  "published_at": "2026-09-30T09:31:12Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-102584",
    "https://access.redhat.com/security/cve/CVE-2026-102584",
    "https://bugzilla.redhat.com/show_bug.cgi?id=2543637",
    "https://moodle.org/mod/forum/discuss.php?d=482502",
    "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88585",
    "https://github.com/advisories/GHSA-fqcg-5c9f-c55v"
  ],
  "repository_advisory_url": null,
  "severity": "medium",
  "source_code_location": "",
  "summary": "A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated...",
  "type": "unreviewed",
  "updated_at": "2026-09-30T09:31:21Z",
  "url": "https://api.github.com/advisories/GHSA-fqcg-5c9f-c55v",
  "vulnerabilities": [],
  "withdrawn_at": null
}
—
CVSS
cvss
NVD4.3
receipt
Source
NVD
Its words
4.3
Read by
field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseScore || field:cve.metrics.cvssMetricV31[].cvssData.baseScore
Said since
2026-10-02 12:00 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://git.moodle.org",
            "defaultStatus": "unaffected",
            "packageName": "moodle",
            "versions": [
              {
                "lessThan": "5.2.2",
                "status": "affected",
                "version": "5.2.0",
                "versionType": "semver"
              },
              {
                "lessThan": "5.1.6",
                "status": "affected",
                "version": "5.1.0",
                "versionType": "semver"
              },
              {
                "lessThan": "5.0.9",
                "status": "affected",
                "version": "5.0.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "patrick@puiterwijk.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "11BA4A97-DFEA-4813-B107-4BA4C0BD78DB",
                "versionEndExcluding": "5.0.9",
                "versionStartIncluding": "5.0.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "37F95B02-166C-45BA-B537-21CB5084001F",
                "versionEndExcluding": "5.1.6",
                "versionStartIncluding": "5.1.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "EFDDCBAE-2DFF-45D6-A90A-2A9AC1743722",
                "versionEndExcluding": "5.2.2",
                "versionStartIncluding": "5.2.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores."
      }
    ],
    "id": "CVE-2026-102584",
    "lastModified": "2026-10-01T14:48:32.280",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 1.4,
          "source": "patrick@puiterwijk.org",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-102584",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-30T13:57:03.802504Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-30T09:17:15.630",
    "references": [
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Patch"
        ],
        "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88585"
      },
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://access.redhat.com/security/cve/CVE-2026-102584"
      },
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Issue Tracking",
          "Third Party Advisory"
        ],
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543637"
      },
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://moodle.org/mod/forum/discuss.php?d=482502"
      }
    ],
    "sourceIdentifier": "patrick@puiterwijk.org",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-425"
          }
        ],
        "source": "patrick@puiterwijk.org",
        "type": "Secondary"
      }
    ]
  }
}
—
CVSS vector
cvss_vector
NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
receipt
Source
NVD
Its words
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Read by
field:cve.metrics.cvssMetricV31[type=Primary].cvssData.vectorString || field:cve.metrics.cvssMetricV31[].cvssData.vectorString
Said since
2026-10-06 12:31 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:31 UTCCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
2026-10-02 12:00 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://git.moodle.org",
            "defaultStatus": "unaffected",
            "packageName": "moodle",
            "versions": [
              {
                "lessThan": "5.2.2",
                "status": "affected",
                "version": "5.2.0",
                "versionType": "semver"
              },
              {
                "lessThan": "5.1.6",
                "status": "affected",
                "version": "5.1.0",
                "versionType": "semver"
              },
              {
                "lessThan": "5.0.9",
                "status": "affected",
                "version": "5.0.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "patrick@puiterwijk.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "11BA4A97-DFEA-4813-B107-4BA4C0BD78DB",
                "versionEndExcluding": "5.0.9",
                "versionStartIncluding": "5.0.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "37F95B02-166C-45BA-B537-21CB5084001F",
                "versionEndExcluding": "5.1.6",
                "versionStartIncluding": "5.1.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "EFDDCBAE-2DFF-45D6-A90A-2A9AC1743722",
                "versionEndExcluding": "5.2.2",
                "versionStartIncluding": "5.2.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores."
      }
    ],
    "id": "CVE-2026-102584",
    "lastModified": "2026-10-01T14:48:32.280",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 1.4,
          "source": "patrick@puiterwijk.org",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-102584",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-30T13:57:03.802504Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-30T09:17:15.630",
    "references": [
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Patch"
        ],
        "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88585"
      },
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://access.redhat.com/security/cve/CVE-2026-102584"
      },
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Issue Tracking",
          "Third Party Advisory"
        ],
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543637"
      },
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://moodle.org/mod/forum/discuss.php?d=482502"
      }
    ],
    "sourceIdentifier": "patrick@puiterwijk.org",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-425"
          }
        ],
        "source": "patrick@puiterwijk.org",
        "type": "Secondary"
      }
    ]
  }
}
—
CWE
cwe
GitHub advisoriesCWE-425
receipt
Source
GitHub advisories
Its words
CWE-425
Read by
field:cwes[].cwe_id
Said since
2026-10-02 11:59 UTC
Last answered
2026-10-06 13:46 UTC
Original
open at the source
What the source handed over
{
  "credits": [],
  "cve_id": "CVE-2026-102584",
  "cvss": {
    "score": 4.3,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 4.3,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
    },
    "cvss_v4": {
      "score": 0.0,
      "vector_string": null
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-425",
      "name": "Direct Request ('Forced Browsing')"
    }
  ],
  "description": "A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores.",
  "epss": {
    "percentage": 0.00196,
    "percentile": 0.08362
  },
  "ghsa_id": "GHSA-fqcg-5c9f-c55v",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-fqcg-5c9f-c55v",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-fqcg-5c9f-c55v"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-102584"
    }
  ],
  "nvd_published_at": "2026-09-30T09:17:15Z",
  "published_at": "2026-09-30T09:31:12Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-102584",
    "https://access.redhat.com/security/cve/CVE-2026-102584",
    "https://bugzilla.redhat.com/show_bug.cgi?id=2543637",
    "https://moodle.org/mod/forum/discuss.php?d=482502",
    "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88585",
    "https://github.com/advisories/GHSA-fqcg-5c9f-c55v"
  ],
  "repository_advisory_url": null,
  "severity": "medium",
  "source_code_location": "",
  "summary": "A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated...",
  "type": "unreviewed",
  "updated_at": "2026-09-30T09:31:21Z",
  "url": "https://api.github.com/advisories/GHSA-fqcg-5c9f-c55v",
  "vulnerabilities": [],
  "withdrawn_at": null
}
—
CWE
cwe
NVDCWE-425
receipt
Source
NVD
Its words
CWE-425
Read by
field:cve.weaknesses[].description[].value
Said since
2026-10-06 12:31 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:31 UTCCWE-425
2026-10-02 12:00 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://git.moodle.org",
            "defaultStatus": "unaffected",
            "packageName": "moodle",
            "versions": [
              {
                "lessThan": "5.2.2",
                "status": "affected",
                "version": "5.2.0",
                "versionType": "semver"
              },
              {
                "lessThan": "5.1.6",
                "status": "affected",
                "version": "5.1.0",
                "versionType": "semver"
              },
              {
                "lessThan": "5.0.9",
                "status": "affected",
                "version": "5.0.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "patrick@puiterwijk.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "11BA4A97-DFEA-4813-B107-4BA4C0BD78DB",
                "versionEndExcluding": "5.0.9",
                "versionStartIncluding": "5.0.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "37F95B02-166C-45BA-B537-21CB5084001F",
                "versionEndExcluding": "5.1.6",
                "versionStartIncluding": "5.1.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "EFDDCBAE-2DFF-45D6-A90A-2A9AC1743722",
                "versionEndExcluding": "5.2.2",
                "versionStartIncluding": "5.2.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores."
      }
    ],
    "id": "CVE-2026-102584",
    "lastModified": "2026-10-01T14:48:32.280",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 1.4,
          "source": "patrick@puiterwijk.org",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-102584",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-30T13:57:03.802504Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-30T09:17:15.630",
    "references": [
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Patch"
        ],
        "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88585"
      },
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://access.redhat.com/security/cve/CVE-2026-102584"
      },
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Issue Tracking",
          "Third Party Advisory"
        ],
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543637"
      },
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://moodle.org/mod/forum/discuss.php?d=482502"
      }
    ],
    "sourceIdentifier": "patrick@puiterwijk.org",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-425"
          }
        ],
        "source": "patrick@puiterwijk.org",
        "type": "Secondary"
      }
    ]
  }
}
—
Exploitation
exploitation
NVDnone
No evidence of exploitation, and no public proof of concept.
receipt
Source
NVD
Its words
none
Read by
field:cve.metrics.ssvcV203[].ssvcData.options[].exploitation
Said since
2026-10-06 12:31 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:31 UTCnone
2026-10-02 12:00 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://git.moodle.org",
            "defaultStatus": "unaffected",
            "packageName": "moodle",
            "versions": [
              {
                "lessThan": "5.2.2",
                "status": "affected",
                "version": "5.2.0",
                "versionType": "semver"
              },
              {
                "lessThan": "5.1.6",
                "status": "affected",
                "version": "5.1.0",
                "versionType": "semver"
              },
              {
                "lessThan": "5.0.9",
                "status": "affected",
                "version": "5.0.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "patrick@puiterwijk.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "11BA4A97-DFEA-4813-B107-4BA4C0BD78DB",
                "versionEndExcluding": "5.0.9",
                "versionStartIncluding": "5.0.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "37F95B02-166C-45BA-B537-21CB5084001F",
                "versionEndExcluding": "5.1.6",
                "versionStartIncluding": "5.1.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "EFDDCBAE-2DFF-45D6-A90A-2A9AC1743722",
                "versionEndExcluding": "5.2.2",
                "versionStartIncluding": "5.2.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores."
      }
    ],
    "id": "CVE-2026-102584",
    "lastModified": "2026-10-01T14:48:32.280",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 1.4,
          "source": "patrick@puiterwijk.org",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-102584",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-30T13:57:03.802504Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-30T09:17:15.630",
    "references": [
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Patch"
        ],
        "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88585"
      },
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://access.redhat.com/security/cve/CVE-2026-102584"
      },
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Issue Tracking",
          "Third Party Advisory"
        ],
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543637"
      },
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://moodle.org/mod/forum/discuss.php?d=482502"
      }
    ],
    "sourceIdentifier": "patrick@puiterwijk.org",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-425"
          }
        ],
        "source": "patrick@puiterwijk.org",
        "type": "Secondary"
      }
    ]
  }
}
—
Fixed in
fixed_in
NVD5.2.2, 5.1.6, 5.0.9
receipt
Source
NVD
Its words
5.2.2, 5.1.6, 5.0.9
Read by
field:cve.affected[].affectedData[].versions[status=affected].lessThan
Said since
2026-10-06 12:31 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:31 UTC5.2.2, 5.1.6, 5.0.9
2026-10-02 12:00 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://git.moodle.org",
            "defaultStatus": "unaffected",
            "packageName": "moodle",
            "versions": [
              {
                "lessThan": "5.2.2",
                "status": "affected",
                "version": "5.2.0",
                "versionType": "semver"
              },
              {
                "lessThan": "5.1.6",
                "status": "affected",
                "version": "5.1.0",
                "versionType": "semver"
              },
              {
                "lessThan": "5.0.9",
                "status": "affected",
                "version": "5.0.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "patrick@puiterwijk.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "11BA4A97-DFEA-4813-B107-4BA4C0BD78DB",
                "versionEndExcluding": "5.0.9",
                "versionStartIncluding": "5.0.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "37F95B02-166C-45BA-B537-21CB5084001F",
                "versionEndExcluding": "5.1.6",
                "versionStartIncluding": "5.1.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "EFDDCBAE-2DFF-45D6-A90A-2A9AC1743722",
                "versionEndExcluding": "5.2.2",
                "versionStartIncluding": "5.2.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores."
      }
    ],
    "id": "CVE-2026-102584",
    "lastModified": "2026-10-01T14:48:32.280",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 1.4,
          "source": "patrick@puiterwijk.org",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-102584",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-30T13:57:03.802504Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-30T09:17:15.630",
    "references": [
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Patch"
        ],
        "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88585"
      },
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://access.redhat.com/security/cve/CVE-2026-102584"
      },
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Issue Tracking",
          "Third Party Advisory"
        ],
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543637"
      },
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://moodle.org/mod/forum/discuss.php?d=482502"
      }
    ],
    "sourceIdentifier": "patrick@puiterwijk.org",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-425"
          }
        ],
        "source": "patrick@puiterwijk.org",
        "type": "Secondary"
      }
    ]
  }
}
—
Severity
severity
GitHub advisoriesmedium
receipt
Source
GitHub advisories
Its words
medium
Read by
field:severity
Said since
2026-10-02 11:59 UTC
Last answered
2026-10-06 13:46 UTC
Original
open at the source
What the source handed over
{
  "credits": [],
  "cve_id": "CVE-2026-102584",
  "cvss": {
    "score": 4.3,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 4.3,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
    },
    "cvss_v4": {
      "score": 0.0,
      "vector_string": null
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-425",
      "name": "Direct Request ('Forced Browsing')"
    }
  ],
  "description": "A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores.",
  "epss": {
    "percentage": 0.00196,
    "percentile": 0.08362
  },
  "ghsa_id": "GHSA-fqcg-5c9f-c55v",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-fqcg-5c9f-c55v",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-fqcg-5c9f-c55v"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-102584"
    }
  ],
  "nvd_published_at": "2026-09-30T09:17:15Z",
  "published_at": "2026-09-30T09:31:12Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-102584",
    "https://access.redhat.com/security/cve/CVE-2026-102584",
    "https://bugzilla.redhat.com/show_bug.cgi?id=2543637",
    "https://moodle.org/mod/forum/discuss.php?d=482502",
    "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88585",
    "https://github.com/advisories/GHSA-fqcg-5c9f-c55v"
  ],
  "repository_advisory_url": null,
  "severity": "medium",
  "source_code_location": "",
  "summary": "A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated...",
  "type": "unreviewed",
  "updated_at": "2026-09-30T09:31:21Z",
  "url": "https://api.github.com/advisories/GHSA-fqcg-5c9f-c55v",
  "vulnerabilities": [],
  "withdrawn_at": null
}
—
Severity
severity
NVDMEDIUM
From 4.0 to 6.9.
receipt
Source
NVD
Its words
MEDIUM
Read by
field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseSeverity || field:cve.metrics.cvssMetricV31[].cvssData.baseSeverity
Said since
2026-10-06 12:31 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:31 UTCMEDIUM
2026-10-02 12:00 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://git.moodle.org",
            "defaultStatus": "unaffected",
            "packageName": "moodle",
            "versions": [
              {
                "lessThan": "5.2.2",
                "status": "affected",
                "version": "5.2.0",
                "versionType": "semver"
              },
              {
                "lessThan": "5.1.6",
                "status": "affected",
                "version": "5.1.0",
                "versionType": "semver"
              },
              {
                "lessThan": "5.0.9",
                "status": "affected",
                "version": "5.0.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "patrick@puiterwijk.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "11BA4A97-DFEA-4813-B107-4BA4C0BD78DB",
                "versionEndExcluding": "5.0.9",
                "versionStartIncluding": "5.0.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "37F95B02-166C-45BA-B537-21CB5084001F",
                "versionEndExcluding": "5.1.6",
                "versionStartIncluding": "5.1.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "EFDDCBAE-2DFF-45D6-A90A-2A9AC1743722",
                "versionEndExcluding": "5.2.2",
                "versionStartIncluding": "5.2.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores."
      }
    ],
    "id": "CVE-2026-102584",
    "lastModified": "2026-10-01T14:48:32.280",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 1.4,
          "source": "patrick@puiterwijk.org",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-102584",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-30T13:57:03.802504Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-30T09:17:15.630",
    "references": [
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Patch"
        ],
        "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88585"
      },
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://access.redhat.com/security/cve/CVE-2026-102584"
      },
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Issue Tracking",
          "Third Party Advisory"
        ],
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543637"
      },
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://moodle.org/mod/forum/discuss.php?d=482502"
      }
    ],
    "sourceIdentifier": "patrick@puiterwijk.org",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-425"
          }
        ],
        "source": "patrick@puiterwijk.org",
        "type": "Secondary"
      }
    ]
  }
}
medium
Status
status
NVDAnalyzed
receipt
Source
NVD
Its words
Analyzed
Read by
field:cve.vulnStatus
Said since
2026-10-02 12:00 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://git.moodle.org",
            "defaultStatus": "unaffected",
            "packageName": "moodle",
            "versions": [
              {
                "lessThan": "5.2.2",
                "status": "affected",
                "version": "5.2.0",
                "versionType": "semver"
              },
              {
                "lessThan": "5.1.6",
                "status": "affected",
                "version": "5.1.0",
                "versionType": "semver"
              },
              {
                "lessThan": "5.0.9",
                "status": "affected",
                "version": "5.0.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "patrick@puiterwijk.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "11BA4A97-DFEA-4813-B107-4BA4C0BD78DB",
                "versionEndExcluding": "5.0.9",
                "versionStartIncluding": "5.0.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "37F95B02-166C-45BA-B537-21CB5084001F",
                "versionEndExcluding": "5.1.6",
                "versionStartIncluding": "5.1.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "EFDDCBAE-2DFF-45D6-A90A-2A9AC1743722",
                "versionEndExcluding": "5.2.2",
                "versionStartIncluding": "5.2.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores."
      }
    ],
    "id": "CVE-2026-102584",
    "lastModified": "2026-10-01T14:48:32.280",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 1.4,
          "source": "patrick@puiterwijk.org",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-102584",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-30T13:57:03.802504Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-30T09:17:15.630",
    "references": [
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Patch"
        ],
        "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88585"
      },
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://access.redhat.com/security/cve/CVE-2026-102584"
      },
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Issue Tracking",
          "Third Party Advisory"
        ],
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543637"
      },
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://moodle.org/mod/forum/discuss.php?d=482502"
      }
    ],
    "sourceIdentifier": "patrick@puiterwijk.org",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-425"
          }
        ],
        "source": "patrick@puiterwijk.org",
        "type": "Secondary"
      }
    ]
  }
}
—
Technical impact
technical_impact
NVDpartial
The attacker gains limited control, or limited information.
receipt
Source
NVD
Its words
partial
Read by
field:cve.metrics.ssvcV203[].ssvcData.options[].technicalImpact
Said since
2026-10-06 12:31 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:31 UTCpartial
2026-10-02 12:00 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://git.moodle.org",
            "defaultStatus": "unaffected",
            "packageName": "moodle",
            "versions": [
              {
                "lessThan": "5.2.2",
                "status": "affected",
                "version": "5.2.0",
                "versionType": "semver"
              },
              {
                "lessThan": "5.1.6",
                "status": "affected",
                "version": "5.1.0",
                "versionType": "semver"
              },
              {
                "lessThan": "5.0.9",
                "status": "affected",
                "version": "5.0.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "patrick@puiterwijk.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "11BA4A97-DFEA-4813-B107-4BA4C0BD78DB",
                "versionEndExcluding": "5.0.9",
                "versionStartIncluding": "5.0.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "37F95B02-166C-45BA-B537-21CB5084001F",
                "versionEndExcluding": "5.1.6",
                "versionStartIncluding": "5.1.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "EFDDCBAE-2DFF-45D6-A90A-2A9AC1743722",
                "versionEndExcluding": "5.2.2",
                "versionStartIncluding": "5.2.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores."
      }
    ],
    "id": "CVE-2026-102584",
    "lastModified": "2026-10-01T14:48:32.280",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 1.4,
          "source": "patrick@puiterwijk.org",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-102584",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-30T13:57:03.802504Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-30T09:17:15.630",
    "references": [
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Patch"
        ],
        "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88585"
      },
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://access.redhat.com/security/cve/CVE-2026-102584"
      },
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Issue Tracking",
          "Third Party Advisory"
        ],
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543637"
      },
      {
        "source": "patrick@puiterwijk.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://moodle.org/mod/forum/discuss.php?d=482502"
      }
    ],
    "sourceIdentifier": "patrick@puiterwijk.org",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-425"
          }
        ],
        "source": "patrick@puiterwijk.org",
        "type": "Secondary"
      }
    ]
  }
}
—
Every claim, by kind

vulnerability

A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores.
zetlyn/cve-nvd · 2026-09-30
automatable no cvss 4.3 cvss_vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N cwe CWE-425 exploitation none fixed_in 5.2.2, 5.1.6, 5.0.9 severity MEDIUM status Analyzed technical_impact partial source
A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated...
zetlyn/cve-ghsa · 2026-09-30
cvss 4.3 cwe CWE-425 severity medium source