CVE-2026-102579

Executive Summary

CVE-2026-102579 is an authorization flaw in the Moodle learning management platform where an incorrect capability check in a grade web service allows an authenticated student to retrieve profile information of other students enrolled in the same course — data they are not permitted to view. The vulnerability requires only a low-privileged authenticated account (CVSS PR:L) and is exploitable over the network without user interaction, resulting in limited but unauthorized confidentiality disclosure. Moodle is widely deployed across universities, K-12 districts, and corporate training environments, where exposure of student PII (names, email addresses, profile fields) carries regulatory and privacy consequences under regimes such as FERPA and GDPR.

Technical Analysis

The defect class is a broken access control condition (CWE-359, Exposure of Private Personal Information to an Unauthorized Actor) manifesting specifically as an incorrect capability check within a Moodle web service responsible for grade-related functionality. In Moodle's architecture, web services are exposed via a REST/SOAP endpoint layer and are gated by capability checks (the has_capability() / context-level permission model) and by per-service role authorization. The report indicates that the check performed in this grade web service is incorrect — i.e., it is either missing, evaluated against the wrong context, or applied against the wrong capability string — such that a student's role context satisfies the check when it should not.

Because the flaw resides in a web service, the attack surface is the network-facing service endpoint rather than the normal web UI. Any authenticated user holding a student role (or an externally authenticated account mapped to that role) can invoke the affected service. The confidentiality impact is scoped as Low (C:L) because the disclosed data is limited to profile information of co-enrolled students rather than credentials, grade values of arbitrary users, or system-level data. There is no integrity or availability impact, and no scope change — the vulnerable component and the impacted component are the same.

No specific function names, class names, endpoint paths, or parameter names are provided in the available NVD/CNA data. Analysts should not assume particular service shortnames or API function identifiers; the determining characteristic is the grade web service's capability enforcement, which will be identifiable in a Moodle codebase by auditing web service definitions that return user/profile data and the capability checks guarding them.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for this CVE. The attack chain below is inferred at the vulnerability-class level from the NVD description.

1. Reconnaissance / target identification. The attacker identifies an Internet- or intranet-reachable Moodle instance and obtains any valid student-level account. This can be a legitimate enrollment, a self-registration if enabled, or a compromised low-privilege credential. The target must expose the web services layer (Moodle mobile app or external service integrations are common reasons this is enabled).

2. Triggering the flaw class. The attacker authenticates as the student and directs a request to the grade web service that exposes profile information. Because the capability check is incorrect, the service does not correctly restrict the response to the caller's own data or to records they are entitled to see. The attacker identifies the request pattern associated with the grade service (e.g., through the Moodle mobile app traffic or API documentation available to authenticated users) and manipulates the target identifier — course and/or user reference — to reference other students in the same course.

3. Execution method. The payload is a standard authenticated web service call (token-based or session-based) with parameters pointing at a peer student's record. No exploit code is required — the vulnerability is exploited by legitimate API invocation with attacker-chosen identifiers, which is characteristic of broken access control issues.

4. Post-exploitation impact. The attacker harvests profile fields of co-enrolled students: display names, email addresses, and any other personal information exposed by the profile view. This enables targeted phishing, account enumeration, doxxing, or correlation with other datasets. The attacker can iterate across the full roster of their course, producing a bulk disclosure rather than a single-record leak.

Impact Assessment

CVSS v3.1 base score is 4.3 (Medium), reflecting AV:N (network-exploitable), AC:L (no special conditions), PR:L (requires an authenticated low-privileged account), UI:N (no victim interaction), S:U (no scope change), C:L (limited confidentiality impact), I:N, A:N. The blast radius is bounded to the population of students co-enrolled in a course with the attacker, but it scales with course size — large lecture courses can contain hundreds or thousands of students whose profiles are exposed in a single campaign.

Business impact centers on privacy and compliance rather than system compromise. In education deployments, disclosure of student profile data can trigger FERPA exposure assessments, GDPR Article 5/32 obligations in EU institutions, and institutional notification requirements. Corporate training instances may leak employee names, email addresses, and organizational role information useful for social engineering. Because exploitation is quiet and uses normal authenticated API traffic, detection is difficult without request-level anomaly analysis. No threat actor campaigns or in-the-wild exploitation have been reported for this CVE, and it is not listed in CISA KEV.

Detection Guidance

Sigma Rule

title: Moodle Grade Web Service Profile Disclosure Attempt
id: 3f7c2a91-8e4d-4b2a-9c15-6d0e9a4f2b77
status: experimental
description: Detects repeated authenticated requests to Moodle web service endpoints consistent with enumeration of student profile data via the grade web service.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102579
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: apache
detection:
  selection_endpoint:
    cs-uri-query|contains:
      - '/webservice/rest/server.php'
      - '/webservice/soap/server.php'
  selection_service:
    cs-uri-query|contains:
      - 'wsfunction='
      - 'gradereport'
  selection_token:
    cs-uri-query|contains: 'wstoken='
  condition: selection_endpoint and selection_service and selection_token
fields:
  - c-ip
  - cs-uri-query
  - cs-username
falsepositives:
  - Legitimate Moodle mobile app synchronization from enrolled students
level: medium
tags:
  - attack.t1213
  - cve.2026.102579

YARA Rule

rule CVE_2026_102579_Moodle_Grade_WS_Capability_Bypass
{
    meta:
        description = "Detects Moodle web service traces referencing grade service calls that may exercise CVE-2026-102579 capability bypass"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102579"
        cve = "CVE-2026-102579"

    strings:
        $ws_rest   = "/webservice/rest/server.php" ascii nocase
        $ws_soap   = "/webservice/soap/server.php" ascii nocase
        $token     = "wstoken=" ascii nocase
        $function  = "wsfunction=" ascii nocase
        $grade     = "grade" ascii nocase
        $profile   = "profile" ascii nocase

    condition:
        (uint16(0) == 0x3C3F or filesize < 5MB) and
        ($ws_rest or $ws_soap) and $token and $function and ($grade or $profile)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102579 Moodle Grade Web Service Profile Disclosure Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/webservice/rest/server.php"; http.uri; content:"wstoken="; http.uri; content:"wsfunction="; http.uri; content:"grade"; fast_pattern; threshold: type both, track by_src, count 20, seconds 60; reference:cve,2026-102579; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102579; classtype:attempted-recon; sid:2026102579; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=2m
  [http where url.path == "/webservice/rest/server.php" and url.query rlike ".*wsfunction=.*" and url.query rlike ".*wstoken=.*"] with runs=10

Splunk SPL Query

index=web sourcetype=access_combined
| where match(uri_query, "wsfunction=") AND match(uri_query, "wstoken=")
| where match(uri, "/webservice/(rest|soap)/server\.php")
| stats count AS ws_calls, dc(uri_query) AS distinct_calls, values(uri_query) AS queries
        by clientip, user
| where ws_calls > 20 AND distinct_calls > 5
| sort - ws_calls
| table clientip, user, ws_calls, distinct_calls, queries

Wazuh OSSEC Rule

<group name="moodle,web,">
  <rule id="202610" level="5">
    <if_sid>31100</if_sid>
    <url>/webservice/(rest|soap)/server\.php</url>
    <description>CVE-2026-102579 - Moodle grade web service request with token observed</description>
    <options>no_full_log</options>
  </rule>
  <rule id="202611" level="9" frequency="10" timeframe="120">
    <if_matched_sid>202610</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-102579 - Possible Moodle grade web service profile enumeration from same source</description>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — no patch evidence has been identified from any tracked source, and no vendor fix, version range, or workaround is documented in the available data. Treat as UNPATCHED.

1. Immediate mitigations.

   • Disable or restrict the Moodle web services layer for student roles where it is not operationally required. If mobile app access is needed, restrict the exposed services to the minimal set that excludes grade/profile services not intended for student consumption.
   • Restrict network access to /webservice/* endpoints to trusted networks or via authenticated reverse proxy filtering.
   • Audit role capability assignments for student roles and remove any capabilities that grant access to peer user profile data through grade-related contexts.

2. Patch/upgrade steps.

   • Monitor the official Moodle security advisories page and the Moodle tracker for the corresponding advisory and fixed release. No CVE-linked version range is available at this time; a patch reference cannot be provided. Apply the vendor fix as soon as it is published, and track this CVE ID for updates in NVD.

3. Long-term hardening.

   • Institute a capability-review process for all web service functions, verifying that each enforces context-appropriate capability checks and does not conflate role context.
   • Enable detailed logging of web service calls (caller identity, service function, target identifiers) and alert on high-volume or cross-course enumeration patterns.
   • Adopt least privilege for all student accounts, disable self-registration where feasible, and require strong authentication to slow account acquisition by external attackers.

References

• NVD — CVE-2026-102579: https://nvd.nist.gov/vuln/detail/CVE-2026-102579
• CWE-359 — Exposure of Private Personal Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/359.html
• MITRE ATT&CK T1213 — Data from Information Repositories: https://attack.mitre.org/techniques/T1213/
• Moodle Security Advisories: https://moodle.org/security/
• FIRST EPSS: Not yet scored for this CVE as of report generation (no EPSS value assigned).

No exploit code, public PoC, Nuclei template, or in-the-wild exploitation evidence is associated with CVE-2026-102579 in the available intelligence.