CVE-2026-102587

Executive Summary

CVE-2026-102587 is an information-disclosure vulnerability in Moodle in which user list filters fail to enforce visibility restrictions on user profile fields. An authorized user holding manager privileges can filter user lists by profile attributes they are not permitted to view directly, allowing them to infer otherwise hidden user data. The impact is confidentiality-limited (CVSS 2.7, C:L only), scoped to a single component, and requires high privileges (PR:H) over the network with no user interaction; there is no public PoC, exploit code, or Nuclei template, and the vulnerability is currently unpatched per tracked sources.

Technical Analysis

The vulnerability maps to CWE-204 (Observable Response Discrepancy) and is rooted in a broken authorization/information-flow control on top of the Moodle user list filtering feature. Moodle managers have the ability to browse and filter user listings (for example, for cohort or enrollment management). Profile fields may be configured with field-level visibility permissions — some fields are visible to a given role, while others are restricted. The flaw is that the filtering logic accepts restricted profile attributes as filter criteria and returns result sets (or result-set differences) that are conditional on those hidden values. When a filter is applied against a restricted attribute, the presence, absence, or count of matching users leaks the hidden value through an observable discrepancy in the response, even though the field's value is never rendered directly.

This is a classic inference/entropy-leak class issue rather than a direct object read: the attacker does not need the restricted field to be displayed, only for the backend query to discriminate on it and for the response to reflect that discrimination. In practical terms, an attacker can iterate over candidate values for a restricted profile field (one request per candidate), branch on the result count, and reconstruct the hidden attribute value — a blind boolean oracle over profile data. The attack surface is the authenticated user list/search interface available to manager accounts (server-side filtering handler), reachable over the network via HTTP(S).

Because the NVD description provides no function names, endpoints, parameter names, file paths, or code snippets, no specific implementation details can be responsibly cited. The mechanism class — filter parameters not gated by the same capability checks that govern direct viewing — is the accurate level of description supported by the data. Root cause is missing or inconsistent enforcement of profile-field visibility (capability/capability-gated field access) inside the filter construction, causing a divergence between "viewable" and "filterable".

Key facts derivable from the data:

• Attack vector: Network (AV:N); attack complexity: Low (AC:L); privileges required: High (PR:H) — manager-level account.
• User interaction: None (UI:N); Scope: Unchanged (S:U).
• Confidentiality impact: Low (C:L); Integrity impact: None (I:N); Availability impact: None (A:N).
• No CISA KEV listing, no public exploit, no Nuclei template, EPSS not scored.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-204 observable response discrepancy enabling blind inference) and the NVD description. No specific function names, endpoints, or parameters are asserted because the source data does not provide them.

Step 1 — Reconnaissance / target identification. The attacker identifies a Moodle instance and holds (or obtains) a valid account with manager privileges. They enumerate the site's user list/profile configuration contextually to determine which profile attributes exist and which are likely restricted from their direct view (for example, custom profile fields whose values do not appear on the user listing but may still be selectable/usable in filters). No exploitation of this CVE is required to reach this state; the prerequisite is legitimate privileged access.

Step 2 — Triggering the flaw class. The attacker submits user-list filter requests using restricted profile attributes as filter criteria. The vulnerability class is an authorization bypass in filter handling: the filter query evaluates against fields the requester may not view. Because the response's match set and match count vary depending on the hidden field value, the attacker obtains an oracle: "does any user match value X for restricted attribute Y?"

Step 3 — Payload/execution method at the vulnerability-class level. For a single hidden field, the attacker applies candidate filter values one at a time (or in a binary-search / partitioned manner) and observes whether the result set changes. This is a blind inference process, not code execution and not a direct data dump. Execution is limited to ordinary authenticated HTTP requests to the user listing/filter interface; the "payload" is the filter criterion value itself. No memory corruption, injection, or remote code execution is involved.

Step 4 — Post-exploitation impact. The attacker reconstructs restricted profile attribute values for targeted users (or classifies users by hidden attributes), resulting in unauthorized disclosure of personal/profile information. Given C:L and S:U, the disclosure is bounded in depth and does not cross a trust boundary; there is no integrity or availability effect. The plausible real-world value is privacy invasion and targeted follow-on attacks (e.g., social engineering informed by hidden attributes such as identifiers or sensitive categorizations), not direct system compromise.

Prerequisites/limitations: requires a manager-level account (PR:H), network access to the instance (AV:N), low complexity (AC:L), and no user interaction (UI:N). No exploit code, no known in-the-wild exploitation, and no KEV entry were provided.

Impact Assessment

Business impact is confidentiality-centric and bounded. Per the CVSS subscores:

• Confidentiality (C:L): limited, incremental disclosure of profile-field values inferable via filtering; not a bulk credential or full-record read.
• Integrity (I:N) and Availability (A:N): none.
• Scope (S:U): impact stays within the affected authorization boundary.
• Attack prerequisites (AV:N, AC:L, PR:H, UI:N): remote and reliable, but gated behind a high-privilege manager account, which materially reduces the exploit population to insiders, compromised manager accounts, or misconfigured over-privileged roles.

Affected systems: Moodle deployments that expose user list filtering to manager-role users and that define profile fields with visibility restrictions. Blast radius is limited to the profile data of users whose restricted attributes are inferable; the CVSS score of 2.7 reflects the high privilege requirement and limited confidentiality effect. Regulatory/privacy exposure (e.g., unauthorized processing of personal data) may exceed the raw technical severity depending on the sensitivity of the hidden fields, but the technical CVSS score remains 2.7.

Detection Guidance

Detection here targets the behavioral signature of blind filter-based enumeration by a manager account: repeated, high-volume user-list filter requests that vary a profile-attribute criterion and whose result counts shift per request. No verified exploit signatures, payloads, or parameter names are available, so detections are written to fire on the anomalous enumeration pattern rather than a specific known payload string. Tune suppression for legitimate roster/HR administration.

Sigma Rule

title: Moodle User List Filter Enumeration of Restricted Profile Fields
id: 8b2f7c1e-3a44-4d9b-9c02-6f5e1d7a20c1
status: experimental
description: Detects repeated authenticated requests to Moodle user list filtering that vary a profile-attribute criterion, consistent with blind inference of restricted profile fields (CVE-2026-102587 / CWE-204).
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: moodle
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/user/index.php'
      - '/admin/user.php'
      - '/user/'
  selection_filter:
    cs-uri-query|contains:
      - 'filter'
      - 'profile'
      - 'field'
  selection_status:
    sc-status: 200
  timeframe: 5m
  condition: selection_path and selection_filter and selection_status | count() by c-ip > 25
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - sc-status
falsepositives:
  - Bulk roster/cohort administration by administrators
  - Automated HR/SSO provisioning scripts
level: medium
tags:
  - attack.t1213
  - cve.2026.102587

YARA Rule

rule CVE_2026_102587_Moodle_Userlist_Filter_Anomaly
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Heuristic detection of anomalous repeated Moodle user-list filter parameters targeting profile attributes; no verified payload exists, use for log/artifact triage only."
        cve = "CVE-2026-102587"
        cwe = "CWE-204"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102587"
        date = "2026-01-01"

    strings:
        $moodle = "moodle" nocase
        $useridx = "/user/index.php" nocase
        $filter  = "filter" nocase
        $profile = "profile" nocase

    condition:
        filesize < 2MB and
        $moodle and
        $useridx and
        any of ($filter, $profile)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102587 Possible Moodle User List Filter Profile-Attribute Enumeration"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/user/"; http.uri; content:"filter"; http.uri; pcre:"/(filter|profile|field)=/Ui"; threshold: type both, track by_src, count 25, seconds 300; classtype:attempted-recon; reference:cve,2026-102587; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102587; metadata:affected_product Moodle, attack_target Web_Server, created_at 2026_01_01; sid:2026102587; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [http where http.request.method == "GET" and
     http.request.url : ("/user/*" or "/admin/user.php") and
     http.request.url : ("*filter*" or "*profile*" or "*field*") and
     http.response.status_code == 200] with runs=25

Splunk SPL Query

index=web sourcetype=moodle_access OR sourcetype=access_combined
| where match(uri_path, "(?i)/user/|/admin/user\.php")
| where match(uri_query, "(?i)filter|profile|field")
| where status=200
| bin _time span=5m
| stats count values(uri_query) as queries by src_ip _time
| where count > 25
| table _time src_ip count queries

Wazuh OSSEC Rule

<group name="moodle,web,attack,">
  <rule id="2026102" level="7" frequency="25" timeframe="300">
    <if_matched_sid>31100</if_matched_sid>
    <match>GET</match>
    <regex type="pcre2">/user/(index\.php|admin/user\.php)?.*(filter|profile|field)=</regex>
    <description>CVE-2026-102587: Possible Moodle user list filter enumeration of restricted profile fields</description>
    <mitre>
      <id>T1213</id>
    </mitre>
    <group>moodle_cve_2026_102587,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations (no vendor fix available):

• Restrict manager privileges to the minimum necessary set; audit all accounts holding manager-level access and remove or downgrade over-privileged users.
• Review the site's profile-field visibility configuration and remove or restrict custom profile fields that do not need to be filterable, if the platform permits disabling them as filter criteria.
• Apply compensating access controls (network restrictions, additional authorization checks, or a Web Application Firewall rule) to limit and monitor user-list filtering by high-privilege roles; alert on high-frequency filter variation as described in the Detection Guidance section.
• Enable detailed logging of authenticated user-list filtering activity and retain it for anomaly review.

2. Patch/upgrade steps:

• No patch is available per tracked sources. Monitor the Moodle security advisories and release channels for a fix and the associated affected-version range.
• When a fixed version is published, identify the corrected release, test in staging, and upgrade promptly; the provided data does not enumerate affected versions, so treat all versions exposing manager-role user-list filtering to restricted profile fields as potentially at risk until the vendor clarifies scope.

3. Long-term hardening:

• Adopt least-privilege role design so that only roles with a genuine need can filter on sensitive profile attributes.
• Enforce consistent capability checks between "query/filter" and "view" operations for sensitive fields — filters should be gated by the same field-level permissions as direct access.
• Establish continuous monitoring for CWE-204-class observable response discrepancies (result-count or response-difference side channels) during authorization testing.
• Include blind-inference/entropy-leak cases in security review and threat modeling for administrative and reporting features.

References

• NVD — CVE-2026-102587: https://nvd.nist.gov/vuln/detail/CVE-2026-102587
• CWE-204 (Observable Response Discrepancy): https://cwe.mitre.org/data/definitions/204.html
• Moodle Security Advisories / announcements: https://moodle.org/security/
• MITRE ATT&CK T1213 (Data from Information Repositories): https://attack.mitre.org/techniques/T1213/
• CISA Known Exploited Vulnerabilities catalog (not listed for this CVE): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit-in-the-wild evidence: none available. No public PoC, exploit code, or Nuclei template provided; no threat actor campaign identified in the supplied data.