CVE-2026-102587

LOW 2.7

Moodle: user list filters bypass profile field visibility

CVSS Score

2.7

EPSS Score

0.0%

EPSS Percentile

0th

A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure by inferring hidden user data.

CWE	CWE-204
Published	Sep 30, 2026

Stay Ahead of the Next One

Get instant alerts for

Be the first to know when new low vulnerabilities are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

References

NVD ↗ CVE.org ↗ EPSS Data ↗

git.moodle.org: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-87518 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-102587 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2543642 moodle.org: https://moodle.org/mod/forum/discuss.php?d=482506

Credits

Upstream acknowledges Martin Greenaway as the original reporter.