{"api_version":"1","generated_at":"2026-10-02T02:20:53+00:00","cve":"CVE-2026-102585","urls":{"html":"https://cve.report/CVE-2026-102585","api":"https://cve.report/api/cve/CVE-2026-102585.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-102585","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-102585"},"summary":{"title":"Moodle: group validation missing when enrolling user to course","description":"A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses they do not have authorization to access.","state":"PUBLISHED","assigner":"fedora","published_at":"2026-09-30 09:17:15","updated_at":"2026-10-01 14:47:35"},"problem_types":["CWE-842","CWE-842 Placement of User into Incorrect Group"],"metrics":[{"version":"3.1","source":"patrick@puiterwijk.org","type":"Secondary","score":"4.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"4.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-102585","name":"https://access.redhat.com/security/cve/CVE-2026-102585","refsource":"patrick@puiterwijk.org","tags":["Third Party Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://moodle.org/mod/forum/discuss.php?d=482503","name":"https://moodle.org/mod/forum/discuss.php?d=482503","refsource":"patrick@puiterwijk.org","tags":["Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88538","name":"http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88538","refsource":"patrick@puiterwijk.org","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543639","name":"https://bugzilla.redhat.com/show_bug.cgi?id=2543639","refsource":"patrick@puiterwijk.org","tags":["Issue Tracking","Third Party Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-102585","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102585","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[{"source":"CNA","time":"2026-09-09T13:08:58.000Z","lang":"en","value":"Reported to Red Hat."},{"source":"CNA","time":"2026-09-29T20:17:12.000Z","lang":"en","value":"Made public."}],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Upstream acknowledges Paul Holden as the original reporter.","lang":"en"}],"nvd_cpes":[{"cve_year":"2026","cve_id":"102585","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"moodle","cpe5":"moodle","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-102585","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-30T13:56:55.836555Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-09-30T15:28:08.543Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"collectionURL":"https://git.moodle.org","defaultStatus":"unaffected","packageName":"moodle","versions":[{"lessThan":"5.2.2","status":"affected","version":"5.2.0","versionType":"semver"},{"lessThan":"5.1.6","status":"affected","version":"5.1.0","versionType":"semver"}]}],"credits":[{"lang":"en","value":"Upstream acknowledges Paul Holden as the original reporter."}],"datePublic":"2026-09-29T20:17:12.000Z","descriptions":[{"lang":"en","value":"A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses they do not have authorization to access."}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Moderate"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-842","description":"Placement of User into Incorrect Group","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-30T08:36:17.130Z","orgId":"92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5","shortName":"fedora"},"references":[{"url":"http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88538"},{"tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-102585"},{"name":"RHBZ#2543639","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543639"},{"url":"https://moodle.org/mod/forum/discuss.php?d=482503"}],"timeline":[{"lang":"en","time":"2026-09-09T13:08:58.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-09-29T20:17:12.000Z","value":"Made public."}],"title":"Moodle: group validation missing when enrolling user to course","x_generator":{"engine":"cvelib 1.8.0"},"x_redhatCweChain":"CWE-842: Placement of User into Incorrect Group"}},"cveMetadata":{"assignerOrgId":"92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5","assignerShortName":"fedora","cveId":"CVE-2026-102585","datePublished":"2026-09-30T08:36:17.130Z","dateReserved":"2026-09-29T14:03:38.494Z","dateUpdated":"2026-09-30T15:28:08.543Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-30 09:17:15","lastModifiedDate":"2026-10-01 14:47:35","problem_types":["CWE-842","CWE-842 Placement of User into Incorrect Group"],"metrics":{"cvssMetricV31":[{"source":"patrick@puiterwijk.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:56:55.836555Z","id":"CVE-2026-102585","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1.0","versionEndExcluding":"5.1.6","matchCriteriaId":"37F95B02-166C-45BA-B537-21CB5084001F"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.2.0","versionEndExcluding":"5.2.2","matchCriteriaId":"EFDDCBAE-2DFF-45D6-A90A-2A9AC1743722"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"102585","Ordinal":"1","Title":"Moodle: group validation missing when enrolling user to course","CVE":"CVE-2026-102585","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"102585","Ordinal":"1","NoteData":"A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses they do not have authorization to access.","Type":"Description","Title":"Moodle: group validation missing when enrolling user to course"}]}}}