{"api_version":"1","generated_at":"2026-10-01T03:17:40+00:00","cve":"CVE-2026-102587","urls":{"html":"https://cve.report/CVE-2026-102587","api":"https://cve.report/api/cve/CVE-2026-102587.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-102587","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-102587"},"summary":{"title":"Moodle: user list filters bypass profile field visibility","description":"A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure by inferring hidden user data.","state":"PUBLISHED","assigner":"fedora","published_at":"2026-09-30 09:17:16","updated_at":"2026-09-30 16:20:44"},"problem_types":["CWE-204","CWE-204 Observable Response Discrepancy"],"metrics":[{"version":"3.1","source":"patrick@puiterwijk.org","type":"Secondary","score":"2.7","severity":"LOW","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"2.7","severity":"LOW","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":2.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}}],"references":[{"url":"http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-87518","name":"http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-87518","refsource":"patrick@puiterwijk.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/security/cve/CVE-2026-102587","name":"https://access.redhat.com/security/cve/CVE-2026-102587","refsource":"patrick@puiterwijk.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://moodle.org/mod/forum/discuss.php?d=482506","name":"https://moodle.org/mod/forum/discuss.php?d=482506","refsource":"patrick@puiterwijk.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543642","name":"https://bugzilla.redhat.com/show_bug.cgi?id=2543642","refsource":"patrick@puiterwijk.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-102587","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102587","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[{"source":"CNA","time":"2026-09-09T13:08:58.000Z","lang":"en","value":"Reported to Red Hat."},{"source":"CNA","time":"2026-09-29T20:17:12.000Z","lang":"en","value":"Made public."}],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Upstream acknowledges Martin Greenaway as the original reporter.","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-102587","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-30T13:56:25.921374Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-09-30T15:28:08.265Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"collectionURL":"https://git.moodle.org","defaultStatus":"unaffected","packageName":"moodle","versions":[{"lessThan":"5.2.2","status":"affected","version":"5.2.0","versionType":"semver"},{"lessThan":"5.1.6","status":"affected","version":"5.1.0","versionType":"semver"},{"lessThan":"5.0.9","status":"affected","version":"5.0.0","versionType":"semver"},{"lessThan":"4.5.13","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","value":"Upstream acknowledges Martin Greenaway as the original reporter."}],"datePublic":"2026-09-29T20:17:12.000Z","descriptions":[{"lang":"en","value":"A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure by inferring hidden user data."}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Low"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":2.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-204","description":"Observable Response Discrepancy","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-30T08:36:21.495Z","orgId":"92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5","shortName":"fedora"},"references":[{"url":"http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-87518"},{"tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-102587"},{"name":"RHBZ#2543642","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543642"},{"url":"https://moodle.org/mod/forum/discuss.php?d=482506"}],"timeline":[{"lang":"en","time":"2026-09-09T13:08:58.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-09-29T20:17:12.000Z","value":"Made public."}],"title":"Moodle: user list filters bypass profile field visibility","x_generator":{"engine":"cvelib 1.8.0"},"x_redhatCweChain":"CWE-204: Observable Response Discrepancy"}},"cveMetadata":{"assignerOrgId":"92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5","assignerShortName":"fedora","cveId":"CVE-2026-102587","datePublished":"2026-09-30T08:36:21.495Z","dateReserved":"2026-09-29T14:03:38.494Z","dateUpdated":"2026-09-30T15:28:08.265Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-30 09:17:16","lastModifiedDate":"2026-09-30 16:20:44","problem_types":["CWE-204","CWE-204 Observable Response Discrepancy"],"metrics":{"cvssMetricV31":[{"source":"patrick@puiterwijk.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:56:25.921374Z","id":"CVE-2026-102587","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"102587","Ordinal":"1","Title":"Moodle: user list filters bypass profile field visibility","CVE":"CVE-2026-102587","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"102587","Ordinal":"1","NoteData":"A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure by inferring hidden user data.","Type":"Description","Title":"Moodle: user list filters bypass profile field visibility"}]}}}