CVE-2026-102580

Executive Summary

CVE-2026-102580 is a vulnerability in Moodle's Report Builder component that permits an authenticated attacker to supply an improperly validated audience class name, resulting in arbitrary class instantiation. The flaw affects Moodle installations exposing the Report Builder feature and requires the attacker to hold an authenticated session with the privileges necessary to interact with the vulnerable component. Impact is assessed as low severity (CVSS 2.2), limited to low integrity effects, with no demonstrated confidentiality or availability impact. No public proof-of-concept, exploit code, or vendor patch is currently available.

Technical Analysis

The vulnerability is classified under CWE-470, "Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')." According to the NVD description, an authenticated attacker can supply an improperly validated audience class name to the Report Builder component of Moodle, which allows arbitrary class instantiation. The result is the unauthorized creation of internal program objects, which may lead to unexpected application behavior.

The root cause is missing or insufficient validation of a class name that is passed to a reflection-style instantiation mechanism. In PHP applications such as Moodle, class instantiation driven by attacker-controlled strings is a recognized risk class: when the identifier is not constrained against an allow-list, the application can be induced to instantiate classes that were never intended to be reachable through that code path. This enables the attacker to construct objects under the application's own execution context rather than injecting foreign code.

The affected component is the Report Builder. The vulnerable parameter is the audience class name, as stated verbatim in the description. No additional technical detail is available: the report does not disclose the specific class, the exact request endpoint, the parameter name as it appears in HTTP traffic, or the underlying instantiation routine. Any attempt to name those specifics would be fabrication. The attack surface is the Report Builder's audience-selection functionality, reachable by an authenticated user with the permissions required to configure or interact with reporting entities.

Exploitability is constrained by CVSS:3.1/AV:N (remotely reachable over the network), AC:H (high attack complexity — exploitation depends on conditions outside the attacker's control, consistent with the need to identify a usable internal class), and PR:H (high privileges required — an authenticated account with elevated Report Builder access). User interaction is Not Required (UI:N), scope is Unchanged (S:U), and the impact vector is C:N/I:L/A:N — no confidentiality impact, low integrity impact, no availability impact. Note that CWE-470 is commonly associated with more severe outcomes in other contexts; the low CVSS score here reflects the described impact as limited to unexpected application behavior via object creation rather than code execution.

Exploitation Scenarios

The attack chain is inferred from the vulnerability class because no public proof-of-concept exists and the disclosure does not provide endpoint, parameter, or code-level specifics.

1. Reconnaissance and target identification. The attacker identifies a Moodle instance with the Report Builder feature enabled and reachable. Fingerprinting can be performed by inspecting the Moodle login page and version-identifying artifacts exposed by the installation. The attacker must then obtain authenticated access with sufficient privileges to reach the Report Builder audience configuration path.

2. Triggering the flaw. The attacker submits a crafted audience class name value through the Report Builder interface. Because the class name is not properly validated prior to use, the value is accepted and used as the selector for class instantiation rather than being restricted to the expected set of audience classes.

3. Execution method at the vulnerability-class level. This is an unsafe-reflection issue. The attacker does not inject external code; instead, the attacker influences which class the application loads and instantiates within its own runtime. The realistic exploitation surface is therefore limited to classes already present in the Moodle codebase (or in loaded libraries) that can be reached by the instantiation routine. Classes with dangerous constructors, autoload side effects, or object state that other components trust could produce state corruption or unexpected behavior. The exact set of reachable classes and the concrete consequences cannot be determined from the available disclosure, and the low CVSS values for confidentiality and availability indicate the described outcome is not direct code execution or data exfiltration.

4. Post-exploitation impact. Per the CVSS vector, the primary effect is low integrity impact: manipulation of internal object state leading to unexpected application behavior. No public PoC available; attack chain is inferred from vulnerability class.

Impact Assessment

Business impact is low relative to the CVSS 2.2 base score. The integrity-only, low-magnitude impact (I:L) means an attacker could plausibly alter the behavior of the Report Builder or objects it depends on, but the disclosure does not support claims of data disclosure or service disruption. The required high privileges (PR:H) and high attack complexity (AC:H) materially shrink the realistic attacker population to authenticated users who already hold elevated reporting access — a set that is often small and, in many deployments, semi-trusted. Because the scope is Unchanged (S:U), impact is confined to the Moodle application's own security authority. Blast radius is therefore bounded by the affected Moodle instance, not by adjacent systems.

Affected systems are Moodle deployments that expose the Report Builder audience configuration to authenticated users. Because no version range is published, all installations with Report Builder enabled should be treated as potentially affected until the vendor provides version guidance. No CISA KEV listing exists (CISA KEV: NO), no EPSS score has been issued by FIRST.org, and no threat actor campaign is associated with this CVE in the available data. There is no evidence of exploitation in the wild.

Detection Guidance

Sigma Rule

title: Suspected Unsafe Class Name Injection in Moodle Report Builder
id: 3f9c1b7e-4a2d-4e77-9b21-moodle-rptbuilder-470
status: experimental
description: Detects requests to Moodle Report Builder paths carrying suspicious backslash- or class-like values suggestive of unsafe class instantiation attempts (CWE-470).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102580
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/reportbuilder/'
      - '/report/'
  selection_class:
    cs-uri-query|contains:
      - 'audience'
      - 'classname'
      - 'class'
  selection_pattern:
    cs-uri-query|re: '(?:%5C|\\\\|[A-Za-z_][A-Za-z0-9_]*(?:%5C|\\\\)[A-Za-z_])'
  condition: selection_path and selection_class and selection_pattern
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs(User-Agent)
falsepositives:
  - Legitimate administrative configuration of audience classes
level: low

YARA Rule

rule CVE_2026_102580_Moodle_ReportBuilder_ClassInstantiation
{
    meta:
        description = "Detects indicators of unsafe class instantiation via Report Builder audience class name (CWE-470)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102580"
        author = "valtersit.com"
        date = "2026-01-01"
        severity = "low"

    strings:
        $rb1 = "reportbuilder" ascii nocase
        $rb2 = "report_builder" ascii nocase
        $aud = "audience" ascii nocase
        $cls = "class name" ascii nocase
        $ns  = /[A-Za-z_][A-Za-z0-9_]*(\\[A-Za-z_][A-Za-z0-9_]*)+/ ascii
        $req = "new " ascii nocase
        $rfl = "ReflectionClass" ascii nocase

    condition:
        uint32(0) == 0x3C3F7068 or true
        and (
            (any of ($rb1, $rb2) and $aud)
            or ($aud and $cls and $ns)
            or ($rfl and $ns and any of ($rb1, $rb2))
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102580 Moodle Report Builder Unsafe Class Name Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"reportbuilder"; nocase; http.uri; content:"audience"; nocase; pcre:"/(%5C|\\\\)[A-Za-z_][A-Za-z0-9_]*/i"; classtype:attempted-recon; reference:cve,2026-102580; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102580; sid:2026102580; rev:1;)
alert http any any -> any any (msg:"CVE-2026-102580 Moodle Report Builder Unsafe Class Name Attempt (POST)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"reportbuilder"; nocase; http.request_body; content:"audience"; nocase; pcre:"/(%5C|\\\\)[A-Za-z_][A-Za-z0-9_]*/i"; classtype:attempted-recon; reference:cve,2026-102580; sid:2026102581; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where http.request.method in ("GET","POST")
      and url.path : "*reportbuilder*"
      and url.query : "*audience*" ]
  [ network where
      url.query regex ".*(%5C|\\\\\\\\)[A-Za-z_][A-Za-z0-9_]*.*" ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:plus:access
| eval uri=coalesce(uri, url, request)
| where match(lower(uri), "reportbuilder|report_builder") AND match(lower(uri), "audience|classname")
| regex uri="(?i)(%5C|\\\\)[A-Za-z_][A-Za-z0-9_]*"
| stats count min(_time) as first_seen max(_time) as last_seen values(clientip) as src_ips values(uri) as sample_uris by status
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,moodle,cve-2026-102580,">
  <rule id="102580" level="5">
    <decoded_as>web-accesslog</decoded_as>
    <if_sid>31100</if_sid>
    <url>reportbuilder|report_builder</url>
    <regex>(?i)audience</regex>
    <regex>(?i)(%5C|\\\\)[A-Za-z_][A-Za-z0-9_]*</regex>
    <description>CVE-2026-102580: Possible Moodle Report Builder unsafe class name instantiation attempt</description>
    <group>cve-2026-102580,moodle,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected version range is published in the available data. The actions below are risk-reduction measures until vendor guidance appears.

1. Immediate mitigations.

• Restrict access to the Report Builder functionality to the smallest possible set of trusted accounts. Reduce the privilege level required to reach the audience configuration path.
• Where Report Builder audience configuration is not operationally required, disable or remove access to the Report Builder feature for non-administrative roles.
• Enforce strong authentication and session controls on accounts with reporting privileges, since PR:H assumes the attacker is already authenticated.
• Monitor web logs for requests to Report Builder paths containing backslash or namespace-like class strings (see detection rules above).

2. Patch/upgrade steps.

• Monitor the Moodle security advisories feed and the NVD record for CVE-2026-102580 for a fixed release. No version range is currently published, so upgrade planning cannot be version-scoped at this time.
• Once a patched version is available, test it in staging, then upgrade production instances and confirm the Report Builder audience path revalidates inputs against an allow-list.

3. Long-term hardening.

• Implement allow-list validation for any externally supplied class name before instantiation; reject values that do not match an explicitly enumerated set of permitted audience classes.
• Apply a code review pattern check for reflection-based instantiation sinks across the codebase (CWE-470), preferring factory or registry patterns over direct string-driven instantiation.
• Deploy a web application firewall in front of Moodle with virtual patching for Report Builder request patterns as an interim compensating control.
• Adopt least-privilege role design for reporting features and maintain asset inventory of Moodle versions so that future version-scoped advisories can be actioned quickly.

References

• NVD — CVE-2026-102580: https://nvd.nist.gov/vuln/detail/CVE-2026-102580
• CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection'): https://cwe.mitre.org/data/definitions/470.html
• Moodle Security Advisories (vendor disclosure channel): https://moodle.org/security/
• FIRST.org EPSS (no score currently published for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-102580 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns, exploit-in-the-wild activity, PoC code, or Nuclei templates are associated with CVE-2026-102580 in the available intelligence data.