The vulnerability in Moodle arises from incorrect processing of IPv4-mapped IPv6 addresses within the URL downloader component's host-blocking mechanism. An authenticated remote attacker can exploit this by crafting URLs that circumvent host restrictions, resulting in SSRF where the server is induced to send requests to otherwise blocked internal or external resources. This flaw does not require user interaction beyond authentication and impacts confidentiality with limited impact on integrity and availability.

An authenticated attacker can bypass host-blocking restrictions and cause the Moodle server to make unauthorized HTTP requests to restricted or internal network destinations. This may lead to information disclosure or interaction with internal services not intended to be accessible externally. The impact is limited to confidentiality with no direct integrity or availability effects reported.

Patch status is not yet confirmed—check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-102577 for current remediation guidance. Until an official fix is available, restrict authenticated user capabilities where possible and monitor for unusual URL downloader activity. No vendor advisory states that no action is required or that the issue is already mitigated.