What’s Vulnerable › Vulnerabilities

CVE-2026-102580: Moodle: arbitrary class instantiation via report builder audience classname

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-30 · updated 2026-10-01
• Weakness: CWE-470

Description

A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected application behavior.

Affected products

• Moodle: before 4.5.13; from 5.0.0 before 5.0.9; from 5.1.0 before 5.1.6; from 5.2.0 before 5.2.2 — fixed in 4.5.13, 5.0.9, 5.1.6, 5.2.2

How to fix

Upgrade to a fixed version: Moodle 4.5.13, 5.0.9, 5.1.6, 5.2.2. Check the vendor advisory for mitigations.

References

• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-89078
• https://access.redhat.com/security/cve/CVE-2026-102580
• https://bugzilla.redhat.com/show_bug.cgi?id=2543635
• https://moodle.org/mod/forum/discuss.php?d=482498

Get alerted when CVE-2026-102580 or the next vulnerability affects your stack