CVE-2026-102588
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In Moodle, the XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. An attacker can trick an authenticated user with grade management permissions into visiting a malicious webpage, triggering unauthorized requests on the victim's behalf. This allows a remote attacker to set or overwrite student grades without authorization.
Risk Assessment
An attacker can modify student grades without authorization, compromising the integrity of grading data and potentially causing academic and legal consequences. It only requires luring a privileged user into clicking a malicious link.
Recommendation
Update Moodle to a version that fixes CSRF token validation in XML grade import. Additionally, consider enforcing the SameSite attribute for session cookies.
Other vulnerabilities in Moodle
See all- CVE-2016-7038High
In Moodle versions 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed.
- CVE-2015-5267High
In Moodle through version 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2, the random_string and complex_random_string functions rely on the PHP mt_rand function, making it easier for remote attackers to predict password-recovery tokens via a brute-force approach.
- CVE-2015-3272High
The clean_param function in lib/moodlelib.php in Moodle has an open redirect vulnerability that allows remote attackers to redirect users to arbitrary websites.
- CVE-2014-7845High
The generate_password function in Moodle through 2.4.11, and in versions 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide a sufficient number of possible temporary passwords, allowing remote attackers to gain access via a brute-force attack.
- CVE-2017-2641Critical
In Moodle versions 2.x and 3.x, SQL injection vulnerability can occur via user preferences.
- CVE-2026-102587Low
A flaw was found in Moodle where user list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure by inferring hidden user data.
- CVE-2026-102586Medium
In Moodle, insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting (XSS) attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary script in the victim's browser.
- CVE-2026-102585Medium
In Moodle, when enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses they do not have authorization to access.
- CVE-2026-102584Medium
In Moodle, due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores.
- CVE-2026-102583Low
A flaw was found in Moodle where an incorrect capability check in the AI editor placement's image generation web service allows an authenticated user to invoke the feature without holding the required capability. This flaw permits unauthorized users to access and utilize the AI image generation functionality.
Original NVD description (English source)
A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthorized requests on the victim's behalf. This flaw allows a remote attacker to set or overwrite student grades without authorization.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS