CVE-2026-102584

Executive Summary

CVE-2026-102584 is a missing authorization (capability) check vulnerability in Moodle, the widely deployed open-source learning management system. A low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permission, allowing unauthorized modification of grade penalty records and potentially altering student assessment scores. The vulnerability carries a CVSS 3.1 base score of 4.3 (Medium), reflecting a network-reachable, low-complexity attack requiring only low privileges, with limited integrity impact and no confidentiality or availability impact. No public proof-of-concept, exploit code, or patch is currently available from tracked sources.

Technical Analysis

This vulnerability is classified as CWE-425: Direct Request ("Forced Browsing"). In the Moodle context, this class of flaw arises when a request handler performs a state-changing operation without first verifying that the calling user holds the specific capability (permission) required for that operation. Moodle's authorization model is built around a capability system in which each feature or action is gated by a named capability, checked at the point of request handling. When a code path that performs a sensitive action omits the corresponding require_capability()-style check, any authenticated user who can reach that code path can execute the action regardless of their assigned role.

According to the NVD description, the specific missing check concerns the recalculation of grade penalties. Grade penalties in Moodle are adjustments applied against a grade item — for example reductions applied for late submission or similar policy-driven deductions. A function that recalculates these penalties is a state-changing operation that modifies persisted grade records. Because the capability check is absent, a low-privileged authenticated user (for example, a student account) can cause the recalculation routine to run, thereby mutating the stored grade penalty data. The description explicitly states this "allows unauthorized users to modify grade penalty records, potentially altering student assessment scores."

Attack surface: the vulnerable operation is reachable over the network (CVSS AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). The attacker must already possess a valid, low-privileged account (PR:L). The scope is unchanged (S:U) — the impact is confined to the Moodle application's authorization domain. Integrity impact is Low (I:L); confidentiality and availability impacts are None (C:N/A:N). The "Low" integrity rating is consistent with modification of a subset of grade data rather than wholesale system compromise.

The available data does not disclose the specific file, class, function, parameter name, or endpoint involved. The description references only the conceptual operation — "recalculation of grade penalties" — and does not name the implementation artifact. Any specific code-level identifiers beyond this are not derivable from the provided intelligence and are therefore not asserted here. No affected version range, OSV package versioning, vendor fix, or workaround is available from tracked sources; the vulnerability must be treated as unpatched pending vendor disclosure.

Exploitation Scenarios

No public proof-of-concept or exploit code is available; the following attack chain is inferred strictly from the vulnerability class (CWE-425, missing capability check) and the NVD description. Specific implementation artifacts are intentionally not fabricated.

1. Reconnaissance / target identification. The attacker identifies a reachable Moodle instance and obtains a valid low-privileged account. In many academic or institutional deployments, self-registration or provisioned student accounts provide this baseline access. The attacker locates the grade-related functionality within the authenticated user interface that exposes the grade penalty recalculation action — that is, the request path that a privileged user (such as a teacher or grade-editing role) would normally invoke.

2. Triggering the flaw. Because the operation lacks a capability check, the attacker — while authenticated only as a low-privileged user — issues the request that invokes the grade penalty recalculation routine directly. The forced-browsing nature of CWE-425 means the attacker does not need to be presented the action in their own UI; they need only reach the handler and cause it to execute. The absence of the authorization gate means the request is processed on the basis of the attacker's authenticated session rather than their (insufficient) privileges.

3. Execution method (class-level). The action is a state-changing, server-side operation delivered over HTTP(S) (matching AV:N / AC:L / UI:N). The attacker submits the request that the recalculation handler accepts. No payload complexity or memory-corruption primitive is involved — the "exploit" is simply an unauthorized but otherwise legitimate request. Whether the request is GET or POST, and which parameters are required, is not disclosed in the available data and is not assumed here.

4. Post-exploitation impact. Successful triggering causes the recalculation routine to run and mutate stored grade penalty records. This can alter the penalty values applied to students' grades, which may in turn change calculated assessment scores. The impact is a targeted integrity violation of academic records. Scope remains unchanged — the attacker gains no lateral movement or privilege escalation beyond the ability to execute this specific action. Per CVSS, there is no confidentiality or availability impact.

Because no PoC, exploit code, or Nuclei template exists in the tracked sources, exploitation is currently assessed as conceptual/theoretical rather than observed in the wild.

Impact Assessment

The CVSS 3.1 base score is 4.3 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The subscores indicate:

• Attack Vector (Network): The vulnerable operation is reachable remotely over the network.
• Attack Complexity (Low): No special conditions or race windows are required; the attacker simply invokes the action.
• Privileges Required (Low): A valid low-privileged account is sufficient — no administrative or teacher-level access needed.
• User Interaction (None): No victim must be tricked or induced to act.
• Scope (Unchanged): The impact stays within the vulnerable component's authorization domain.
• Confidentiality (None) / Availability (None): No data disclosure or service disruption.
• Integrity (Low): Unauthorized modification of grade penalty records.

Business impact: The primary impact is the integrity of academic assessment data. Tampering with grade penalties can produce incorrect final scores, which carries institutional and compliance ramifications: disputed grades, appeals, audit findings, and reputational damage to the institution operating the Moodle instance. Blast radius is bounded by the scope of the recalculation routine — potentially all students and grade items whose penalties are recalculated. The exploitation threshold is low: any authenticated low-privileged user (e.g., a student) in an affected deployment could theoretically trigger it, broadening the population of potential abusers. Because no affected version range is known, the entire deployed base of unknown-version Moodle instances must be considered at risk until the vendor bounds the affected releases. No CISA KEV listing, no EPSS score, and no known threat-actor campaign are associated with this CVE.

Detection Guidance

Sigma Rule

title: Moodle Grade Penalty Recalculation by Low-Privileged User
id: 8f3c1a20-4b7e-4d9a-9c11-moodle102584
status: experimental
description: Detects requests to grade penalty recalculation functionality by authenticated users lacking grading capabilities (CVE-2026-102584, CWE-425).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102584
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: moodle
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/grade/'
      - '/grade/report'
  selection_action:
    cs-uri-query|contains:
      - 'recalc'
      - 'penalt'
  filter_privileged:
    sc-status: 200
  condition: selection_path and selection_action
falsepositives:
  - Legitimate grading actions by teachers and course managers
level: medium
tags:
  - attack.t1565.001
  - cve.2026.102584

Note: endpoint and parameter tokens shown (e.g., recalc, penalt) are illustrative detection scaffolding for context matching and are not asserted as verbatim identifiers from the vulnerability data; tune against observed Moodle request logs.

YARA Rule

rule CVE_2026_102584_Moodle_Missing_Capability_Check
{
    meta:
        description = "Heuristic detection of grade penalty recalculation code paths that may lack a capability check (CVE-2026-102584)"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102584"
        cve = "CVE-2026-102584"
        date = "2026-01-01"
    strings:
        $recalc   = "recalculate" ascii nocase
        $penalty  = "penalty" ascii nocase
        $grades   = "grade_penalt" ascii nocase
        $capcheck = "require_capability" ascii nocase
    condition:
        uint16(0) == 0x3C3F or uint32(0) == 0x70726F78
        or (2 of ($recalc, $penalty, $grades) and not $capcheck)
}

Note: this rule is a heuristic scanner for PHP source files; the string require_capability is Moodle's documented capability-check idiom, referenced here as a heuristic marker. It is not claimed verbatim from the advisory.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102584 Moodle Grade Penalty Recalculation Attempt"; flow:established,to_server; http.uri; content:"/grade/"; http.uri; content:"recalc"; http.method; content:"GET"; sid:1025840; rev:1; reference:cve,2026-102584; classtype:attempted-user; metadata:affected_product Moodle;)

Elastic Detection

sequence by user.name with maxspan=30s
  [ network where url.path : "/grade/*" and url.query : "*recalc*" ]

Rule intent: flag low-privileged sessions reaching grade recalculation endpoints. Adjust url.path and url.query globs to the deployment's actual Moodle routing once the precise path is confirmed.

Splunk SPL Query

index=web sourcetype=moodle_access
| search uri_path="*/grade/*" (uri_query="*recalc*" OR uri_query="*penalt*")
| stats count min(_time) as first_seen max(_time) as last_seen values(status) as status by src_ip, user, uri_path
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="moodle,web,cve-2026-102584,">
  <rule id="102584" level="7">
    <decoded_as>json</decoded_as>
    <field name="url">/grade/</field>
    <regex field="url">recalc|penalt</regex>
    <description>CVE-2026-102584: possible unauthorized Moodle grade penalty recalculation request</description>
    <mitre>
      <id>T1565.001</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch, vendor fix, or workaround is available from any tracked source. The following guidance is interim and must be revisited once the vendor publishes an advisory.

1. Immediate mitigations (compensating controls):

   • Restrict network access to grade-related functionality at the reverse proxy / WAF layer, allowing only trusted roles or internal networks where feasible.
   • Apply WAF rules that flag or block requests to grade penalty recalculation paths originating from sessions mapped to low-privileged roles.
   • Review role assignments and, if the affected operation permits it, disable or constrain the feature through existing role configuration until patched.
   • Monitor Moodle audit logs and web access logs for anomalous invocations of grade recalculation actions by non-privileged accounts (see detection rules above).
   • Preserve and hash grade-related records to establish integrity baselines for forensic comparison.

2. Patch / upgrade steps: No fixed release is identified. Continuously monitor the Moodle security advisories and the NVD entry for CVE-2026-102584. When a patched version is released, stage it in a test environment, validate grade-related functionality, and upgrade production promptly. Track the vendor's affected-version disclosure once published, as the version range is currently unknown.

3. Long-term hardening:

   • Enforce a defense-in-depth authorization model: every state-changing handler should perform an explicit capability check server-side, independent of UI presentation.
   • Adopt automated static analysis that flags state-changing functions lacking capability gates.
   • Log all grade modifications with actor identity, timestamp, and before/after values for auditability and tamper detection.
   • Institute least-privilege account provisioning and periodic access reviews for the Moodle deployment.
   • Establish a patch-response process timed to the vendor's security release cadence.

References

• NVD — CVE-2026-102584: https://nvd.nist.gov/vuln/detail/CVE-2026-102584
• CWE-425: Direct Request ("Forced Browsing") — https://cwe.mitre.org/data/definitions/425.html
• Moodle Security Advisories (monitor for CVE-2026-102584 disclosure): https://moodle.org/security/
• MITRE ATT&CK T1565.001 — Stored Data Manipulation: https://attack.mitre.org/techniques/T1565/001/
• CISA Known Exploited Vulnerabilities Catalog (not currently listed — verify): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit-in-the-wild status: None observed. No PoC, exploit code, or Nuclei template is available in tracked sources; no associated threat-actor campaign has been reported. Exploitation remains theoretical at the time of writing.