Moodle Project vulnerabilities and threats

Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the core_grades_get_gradeitems web service that allows enrolled students to view hidden grade items. Authenticated course users can call the AJAX or mobile web service to list hidden grade item ids, names, and categories that the gradebook conceals from them.

CVE-2026-119555 is an information disclosure vulnerability in Moodle versions 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0. The flaw exists in the core_grades_get_feedback web service, which does not enforce group-membership and enrolment checks. This allows non-editing teachers to iterate user IDs and access grade feedback and personal identity fields such as email addresses of users outside their authorized groups.

CVE-2026-119554 is an SQL injection vulnerability in Moodle's External database enrolment plugin affecting multiple versions including 5.3.0 and earlier releases down to 4.5.15. The flaw allows editing teachers to inject malicious SQL payloads via the course idnumber field, which executes during scheduled synchronization with MySQL/MariaDB external databases. This can lead to unauthorized reading of data and manipulation of enrolment results.

Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contains a path traversal vulnerability in the Blackboard question import format. Teachers with question import or lesson edit rights can upload a crafted zip with img src values containing ../ sequences, copying server files like config.php into their draft area.