CVE-2026-66375
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.
Risk Assessment
Removal of metadata may disrupt system operations, compromise data integrity, and affect service availability.
Recommendation
It is recommended to restrict permissions for metadata deletion and implement backup and audit mechanisms.
Other vulnerabilities in Repositories
See all- CVE-2014-3541High
The Repositories component in Moodle through 2.3.11, and in versions 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via serialized data associated with an add-on.
- CVE-2025-13488Medium
Due to a regression introduced in version 3.83.0, a security header is no longer applied to certain user-uploaded content served from repositories. This may allow an authenticated attacker with repository upload privileges to exploit a stored cross-site scripting (XSS) vulnerability with user context.
Original NVD description (English source)
A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS