CVE-2026-102585

Executive Summary

CVE-2026-102585 is an improper authorization vulnerability in the Moodle learning management system. When a user is enrolled into a course and simultaneously assigned to a group, the application fails to verify that the selected group actually belongs to the target course. An authenticated user holding teacher-level privileges can abuse this gap to add users to groups inside courses they are not authorized to access. The impact is limited to integrity (CVSS 4.3, I:L) with no confidentiality or availability effect, but it enables unauthorized cross-course membership manipulation.

Technical Analysis

The vulnerability resides in Moodle's course enrollment workflow — specifically in the code path that handles enrolling a user into a course while assigning that user to a group. Per the NVD description, the application "does not verify whether the selected group actually belongs to that course."

The root cause is a missing authorization/ownership check between two related objects: the course being enrolled into and the group being assigned. In a correctly implemented flow, the server should validate that the group ID supplied during enrollment is a member of (is owned by) the course the enrollment targets. Because that validation is absent, an attacker who can reach the enrollment-with-group functionality can supply a group identifier that belongs to a different course.

This maps to CWE-842 (Placement of User into Incorrect Group). The security boundary being violated is course-level authorization: the acting teacher is permitted to manage enrollment in their own course, but the missing check allows that action to leak into the membership structure of a course outside their authorization scope.

Attack surface characteristics:

• Network reachable (AV:N) — the enrollment operation is exposed over the web interface/API.
• Low privileges required (PR:L) — the actor must already be an authenticated user with teacher privileges on at least one course.
• No user interaction (UI:N) — the victim account does not need to take any action.
• Scope unchanged (S:U) — the flaw stays within Moodle's authorization model; it does not enable control of other components.
• Integrity only (I:L) — group membership data can be altered without a corresponding confidentiality or availability impact.

No public proof-of-concept, Nuclei template, or exploit code is available for this CVE. The precise request parameters, endpoint paths, and internal function names involved in the enrollment-with-group operation are not disclosed in the provided intelligence and are therefore not specified here. Analysis is limited to the vulnerability class and mechanism described above.

Exploitation Scenarios

The following attack chain is inferred strictly from the vulnerability class and the NVD description. No specific endpoint names, parameter names, or code identifiers are asserted because none are provided in the source data.

1. Reconnaissance / target identification An attacker authenticates to Moodle with an account that holds teacher privileges in at least one course. Through ordinary browsing of courses and groups, the attacker enumerates group identifiers and learns which groups belong to which courses. Because Moodle exposes course and group structures to enrolled participants, identifying a target group in a course the attacker does not teach is feasible with normal authenticated access.

2. Triggering the flaw class The attacker initiates an enrollment action on a course they control (or are authorized to manage) and, during that same operation, specifies a group that belongs to a different, out-of-scope course. The application does not validate that the group is owned by the course being enrolled into. This is the missing authorization check — the core of CWE-842.

3. Payload / execution at the vulnerability-class level At the class level, the "payload" is simply a mismatched object reference: a group identifier that is valid in the system but not a member of the target course. The attacker submits the enrollment-plus-group-assignment request with this cross-course group value. The server accepts it because the ownership relationship between the course and the group is never verified. No memory corruption, injection, or code execution is involved — this is a broken access control / improper placement flaw.

4. Post-exploitation impact The targeted user is placed into a group that belongs to a course the attacker does not have authorization to access. This corrupts the membership model of the out-of-scope course: the victim may inherit group-scoped visibility, activity, or assignment context they should not have, and the attacker achieves a placement effect in a course beyond their privileges. The direct confidentiality and availability impact is none; the demonstrated effect is unauthorized modification of group membership across a course authorization boundary.

Because no public PoC is available, this chain represents the exploitation path logically implied by the vulnerability class rather than a verified, weaponized sequence.

Impact Assessment

CVSS 3.1 base score: 4.3 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.

Subscore interpretation:

• AV:N — exploitable remotely across the network via Moodle's web interface; no local access required.
• AC:L — no special conditions or race conditions needed; the check is simply absent.
• PR:L — the attacker must already hold a low-privileged authenticated account with teacher rights in some course.
• UI:N — the affected user need not interact with any lure for the placement to occur.
• S:U — impact is confined to the authorization domain of the vulnerable component.
• C:N / I:L / A:N — no confidentiality loss, limited integrity impact, no availability impact.

Business impact: The flaw undermines the integrity of Moodle's course and group membership model. In academic or corporate learning environments, unauthorized cross-course group placement can leak learners into cohort structures, distort assessment groupings, and compromise the correctness of permission boundaries. The blast radius is bounded by the requirement for teacher-level authentication and the low integrity impact, but in large multi-tenant Moodle deployments, cross-course misplacement can be repeated across many groups to incrementally corrupt the membership dataset.

Affected systems: Moodle deployments that expose the enrollment-with-group-assignment workflow. No specific affected version range was provided by tracked sources, so a definitive affected-version statement cannot be made. No CISA KEV listing exists, and no exploit-in-the-wild evidence is reported.

Detection Guidance

Note: the rules below are behavioral detections for the misuse of the enrollment-and-group-assignment workflow and for anomalous cross-course group changes. They are not tied to disclosed parameter names, since none were provided.

Sigma Rule

title: Moodle Group Assignment Cross-Course Authorization Abuse (CVE-2026-102585)
id: 7c9a1f42-3b6e-4d21-9c8a-2f0e5b7d1a63
status: experimental
description: Detects group-membership additions to courses that may indicate missing ownership validation when enrolling a user into a course and assigning a group.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102585
author: valtersit.com
date: 2026-01-01
logsource:
  product: moodle
  service: webserver
detection:
  selection_method:
    cs-method:
      - 'POST'
      - 'GET'
  selection_action:
    cs-uri-query|contains:
      - 'action=addmember'
      - 'groupid='
      - 'group='
      - 'enrol'
  selection_group:
    cs-uri-query|contains: 'group'
  filter_admin:
    c-ip: []   # populate with trusted administrative source addresses
  condition: selection_method and selection_action and selection_group and not filter_admin
falsepositives:
  - Legitimate teacher group-management activity within their own courses
level: medium
tags:
  - attack.t1078
  - cwe.842

YARA Rule

rule CVE_2026_102585_Moodle_Group_Cross_Course_Abuse
{
    meta:
        description = "Detects references to cross-course group assignment handling related to CVE-2026-102585 in Moodle web logs or source artifacts"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102585"
        author = "valtersit.com"
        date = "2026-01-01"
        cwe = "CWE-842"
    strings:
        $grp  = "groupid" ascii nocase
        $enr  = "enrol" ascii nocase
        $mem  = "addmember" ascii nocase
        $crs  = "courseid" ascii nocase
    condition:
        ( $grp and $enr ) or ( $mem and $grp and $crs )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102585 Moodle cross-course group assignment attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"enrol"; nocase; http.uri; content:"group"; nocase; http.uri; pcre:"/group(id)?=[0-9]+/i"; classtype:attempted-user; reference:cve,2026-102585; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102585; sid:2026102585; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ network where http.request.method == "POST" and url.path : "enrol*" and url.query : "group*" ]
  [ any where event.category == "iam" and event.action in ("group-member-added", "group-member-updated") ]

Splunk SPL Query

index=web sourcetype=moodle_access
| eval uri=lower(uri)
| where like(uri,"%enrol%") AND like(uri,"%group%") AND match(uri,"group(id)?=\d+")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, user, uri
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="moodle,cve-2026-102585,">
  <rule id="102585" level="8">
    <decoded_as>web-accesslog</decoded_as>
    <match>enrol</match>
    <regex>group(id)?=\d+</regex>
    <description>CVE-2026-102585: Possible Moodle cross-course group assignment / authorization abuse</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected version range has been published in the provided intelligence. The owner of this CVE is the Moodle project; administrators should monitor the official Moodle security announcements and tracker for the corresponding fix.

1. Immediate mitigations

• Restrict teacher-level accounts to the minimum necessary population; the vulnerability requires an authenticated user with teacher privileges, so privilege minimization directly reduces exposure.
• Audit course and group membership for unexpected cross-course placements: review group membership changes where the group's owning course differs from the affected user's enrolled courses.
• Temporarily constrain group-management capabilities (for example, limit who may assign users to groups during enrollment) to trusted roles until a fix is available.
• Monitor and log enrollment-with-group operations and alert on group identifiers that do not correspond to the course being targeted.

2. Patch/upgrade steps

• No patched version is identified in the provided data. Monitor the Moodle security announcements page and the official tracker for the CVE-2026-102585 fix, then apply the vendor-provided update as soon as it is released.
• After patching, re-validate that group ownership is enforced during enrollment; test in a staging instance before production rollout.

3. Long-term hardening

• Enforce server-side validation that any group supplied during enrollment is owned by the target course, and add regression tests for cross-course object references.
• Adopt consistent authorization checks for object-to-object relationships (course↔group) across enrollment and membership workflows.
• Apply least-privilege role design and periodic access reviews for teacher and course-management roles.
• Integrate enrollment/membership change events into SIEM monitoring to detect anomalous cross-course activity patterns.

References

• NVD — CVE-2026-102585: https://nvd.nist.gov/vuln/detail/CVE-2026-102585
• CWE-842 (Placement of User into Incorrect Group): https://cwe.mitre.org/data/definitions/842.html
• Moodle Security Announcements: https://moodle.org/security/
• Moodle Tracker (search "CVE-2026-102585"): https://tracker.moodle.org/
• FIRST EPSS: Not yet scored — https://www.first.org/epss/

No CISA KEV listing, public proof-of-concept, Nuclei template, or exploit-in-the-wild evidence is associated with this CVE at the time of writing. No threat actor campaigns targeting CVE-2026-102585 have been reported.