CVE-2026-102585: Moodle: group validation missing when enrolling user to course

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-30 · updated 2026-10-01
Weakness: CWE-842

Description

A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses they do not have authorization to access.

Affected products

Moodle: from 5.1.0 before 5.1.6; from 5.2.0 before 5.2.2 — fixed in 5.1.6, 5.2.2

How to fix

Upgrade to a fixed version: Moodle 5.1.6, 5.2.2. Check the vendor advisory for mitigations.

References

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88538
https://access.redhat.com/security/cve/CVE-2026-102585
https://bugzilla.redhat.com/show_bug.cgi?id=2543639
https://moodle.org/mod/forum/discuss.php?d=482503

Get alerted when CVE-2026-102585 or the next vulnerability affects your stack