CVE-2026-102582

Executive Summary

CVE-2026-102582 is an authorization-control flaw in Moodle's manual enrolment management page. The page failed to verify whether the manual enrolment plugin was disabled, so a user holding enrolment permissions could reach the management page directly by URL and continue managing manual enrolments even after an administrator disabled the feature in the UI. The impact is a low-integrity authorization bypass scoped to a single feature toggle, rated CVSS 2.2 with High attack complexity and High privileges required.

Technical Analysis

The vulnerability class is CWE-425, Direct Request ("Forced Browsing"). This class describes a condition in which an application does not enforce an authorization or state check on a resource that is reachable by direct URL, relying instead on the absence of a UI link or menu entry as the only barrier. In this instance, the manual enrolment management page in Moodle did not properly check whether the manual enrolment plugin was disabled. Administrators who disabled the manual enrolment capability via the user interface expected that the feature was no longer usable. The page, however, remained reachable, and the missing enforcement was the state check on the plugin's enabled/disabled status at the point the page was served and its actions processed.

The attack surface here is not the public internet edge but the authenticated Moodle session. The CVSS vector confirms this profile precisely: AV:N (the page is reachable over the network via HTTP/HTTPS), AC:H (High attack complexity — the attacker must know or discover the direct URL path and already possess the enrolment permission set required to act on the page), PR:H (High privileges required — the actor must be an authorized user with enrolment permissions, not an anonymous visitor), UI:N (no victim interaction needed once the actor has the URL), S:U (impact confined to the Moodle authorization scope), C:N (no confidentiality impact), I:L (limited integrity impact — enrolment records could be altered), A:N (no availability impact).

Because the CNA title and NVD description are the only source material provided, and neither names specific source files, PHP controllers, class names, function names, or URL parameters, this report does not assert any of those. What can be stated with confidence is the enforcement gap itself: a state validation on plugin enablement that was absent from the code path servicing the management page. No public proof-of-concept, no Nuclei template, and no exploit code were available at the time of analysis, so the precise request shape cannot be characterized beyond the vulnerability class. The CVSS subscores are the most reliable signal of how reachable and exploitable the flaw is in practice: this is a narrow, authenticated, feature-toggle bypass rather than a remote unauthenticated compromise.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-425, Direct Request) and the CVSS vector. No specific URL endpoints, parameters, or code identifiers are asserted because the provided description does not supply them.

1. Reconnaissance / target identification. The actor already holds a valid Moodle account with enrolment permissions on the target site. The actor observes that manual enrolment has been disabled by the administrator — for example because the UI no longer exposes the control, or because the actor was previously able to use the feature and it has since disappeared. No external scanning is required; the identifying information is the knowledge of the direct URL for the manual enrolment management page, which is the sort of path a user with prior access to the feature would have seen.

2. Triggering the flaw class. The actor authenticates normally and then requests the manual enrolment management page directly by its URL, bypassing the user interface entirely. Because the page did not properly check whether the manual enrolment plugin was disabled, the request is served rather than refused. The missing control is the plugin-state enforcement check, not an authentication check — the actor is legitimately authenticated and legitimately holds enrolment permissions, which is why PR is High and AC is High rather than Low.

3. Execution method at the vulnerability-class level. With the page reachable, the actor interacts with the manual enrolment management functionality the page provides — the same actions an administrative or enrolment manager would take through the UI when the feature is enabled. The description states the actor "could manage manual enrolments," so the effect is realized through whatever enrolment-management operations that page exposes. No payload is delivered beyond a crafted direct HTTP request; the "exploit" is simply the direct navigation the description calls out.

4. Post-exploitation impact. The integrity impact is limited (I:L) and confidentiality and availability impacts are None. The realistic outcome is unauthorized modification of manual enrolment state for the courses the actor can reach within their existing permissions — adding, changing, or removing manual enrolments the administrator intended to be frozen by disabling the plugin. There is no privilege escalation to site administration implied by the description, no data exfiltration, and no denial of service.

Impact Assessment

The blast radius is bounded by the attacker's pre-existing enrolment permissions and by the courses those permissions cover. This is not a mass-exploitation candidate. It matters in environments where disabling manual enrolment is a deliberate governance or compliance control — for example, institutions that switch off manual enrolment during enrollment freezes, audit windows, or when migrating to a different enrolment method — because the control can be silently circumvented by any user who retains enrolment permissions and knows the direct URL. Integrity impact is limited (I:L): enrolment records within scope can be altered. Confidentiality impact is None (C:N): the description does not indicate exposure of grade, identity, or course content data. Availability impact is None (A:N). Exploitability is constrained by High attack complexity (AC:H) and High privileges required (PR:H), yielding a base score of 2.2. There is no CISA KEV listing, no known exploitation in the wild, and no public exploit code at the time of writing. EPSS has not yet been scored by FIRST.org, so no probability estimate is asserted.

Detection Guidance

Detection should focus on authenticated requests to the manual enrolment management page that occur when the feature is administratively disabled, and on enrolment-state changes attributable to users operating outside the normal UI flow. Because the vulnerability is a direct-request authorization bypass, the highest-fidelity signal is server-side: compare the configured state of the manual enrolment plugin against access events for its management page. Log-based detections below are written generically because the provided data does not disclose the exact URL path, parameter names, or log field names; adjust field mappings to your Moodle deployment and web-tier logging schema before production use.

Sigma Rule

title: Potential Moodle Manual Enrolment Management Page Access While Plugin Disabled
id: 3f9a1c2e-7b64-4d51-9c0a-0e5b2a6d8f31
status: experimental
description: Detects authenticated HTTP requests to the Moodle manual enrolment management page, which may indicate exploitation of CVE-2026-102582 (direct request bypass of a disabled manual enrolment plugin).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102582
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1078
  - attack.initial_access
logsource:
  category: webserver
  product: moodle
detection:
  selection_method:
    cs-method:
      - GET
      - POST
  selection_path:
    cs-uri-stem|contains:
      - '/enrol/manual'
      - '/enrol/'
  selection_keyword:
    cs-uri-query|contains:
      - 'enrol'
      - 'manage'
  condition: selection_method and selection_path and selection_keyword
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate administrative access while manual enrolment is enabled
  - Plugin configuration and upgrade activity by site administrators
level: medium

YARA Rule

rule CVE_2026_102582_Moodle_Manual_Enrolment_Direct_Request
{
    meta:
        description = "Detects Moodle PHP source that references the manual enrolment management page without an evident plugin-enabled check. Heuristic indicator only; requires analyst validation."
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102582"
        cve = "CVE-2026-102582"

    strings:
        $a1 = "manual" ascii nocase
        $a2 = "enrol" ascii nocase
        $b1 = "enabled" ascii nocase
        $b2 = "is_enabled" ascii nocase
        $c1 = "require_login" ascii nocase
        $c2 = "require_capability" ascii nocase

    condition:
        filesize < 512KB and
        (2 of ($a*)) and
        (1 of ($b*)) and
        any of ($c*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102582 Moodle manual enrolment management page direct request"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/enrol/"; http.uri; content:"manual"; nocase; classtype:attempted-user; reference:cve,2026-102582; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102582; sid:9026582; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ http where http.request.method in ("GET", "POST") and
      http.request.uri : ("/enrol/manual*" or "/enrol/*manual*") ]
  [ http where http.request.method in ("GET", "POST") and
      http.response.status_code == 200 and
      http.request.uri : ("/enrol/manual*" or "/enrol/*manual*") ]

Splunk SPL Query

index=web sourcetype=moodle_access OR sourcetype=apache_access OR sourcetype=nginx_access
(http.url="*enrol/manual*" OR uri_path="*enrol/manual*")
| eval user=coalesce(user, cs_username, remote_user, "-")
| stats count min(_time) as first_seen max(_time) as last_seen values(status) as status_codes by src_ip, user, uri_path
| where count > 0
| sort - count
| table first_seen, last_seen, src_ip, user, uri_path, status_codes, count

Wazuh OSSEC Rule

<group name="moodle,web,app,">
  <rule id="100582" level="6">
    <decoded_as>web-accesslog</decoded_as>
    <url>enrol/manual</url>
    <description>CVE-2026-102582 Possible Moodle manual enrolment management page access (direct request bypass of disabled plugin)</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>cve_2026_102582,web_scan,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version range was supplied with the available data; treat the guidance below as compensating control strategy rather than a fixed-version upgrade path.

1. Immediate mitigations. Treat the manual enrolment plugin state as untrusted until a fix exists. Enforce the plugin-disabled condition at the web tier, not only in application logic, by restricting the manual enrolment management URL to site administrators (or denying it entirely) for accounts that do not require it. Reduce the population holding enrolment permissions to the minimum necessary, since PR is High and the flaw is only usable by users who already possess those permissions. Audit existing manual enrolment records and recent enrolment changes for unexplained modifications, particularly in periods when the feature was supposed to be disabled. If the deployment does not use manual enrolment at all, ensure the plugin is uninstalled rather than merely disabled so the page is not present.

2. Patch/upgrade steps. No patch is available from any tracked source at this time. Monitor the Moodle security advisories and release notes for the version that resolves CVE-2026-102582, and subscribe to the NVD record for update status. When a fixed release is published, apply it through the standard Moodle upgrade path after backing up the database and code tree; verify the fix by confirming that direct requests to the manual enrolment management page are refused when the plugin is disabled. Until then, do not rely on the administrative toggle alone as a security boundary.

3. Long-term hardening. Adopt defense-in-depth for feature toggles: every capability-disabled state that matters for authorization should be enforced server-side at the point of request handling, not only by removing UI affordances. Apply least privilege to enrolment roles and review them on a schedule. Enable detailed web access logging with authenticated usernames and full URI paths so that direct-request bypass attempts are visible. Maintain a configuration baseline so any drift in enrolment-plugin state is detected. Validate these practices during routine access-control reviews, and treat any discrepancy between an administrative toggle and actual feature reachability as a security finding.

References

• NVD — CVE-2026-102582: https://nvd.nist.gov/vuln/detail/CVE-2026-102582
• Moodle Security Announcements (vendor advisory channel): https://moodle.org/security/
• CWE-425 — Direct Request ("Forced Browsing"): https://cwe.mitre.org/data/definitions/425.html
• FIRST EPSS (no score available at time of writing): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns, exploit-in-the-wild activity, public PoC, or Nuclei template were identified for CVE-2026-102582 from the data provided.