CVE-2026-119553

In Moodle versions 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed.

In Moodle through version 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2, the random_string and complex_random_string functions rely on the PHP mt_rand function, making it easier for remote attackers to predict password-recovery tokens via a brute-force approach.

The clean_param function in lib/moodlelib.php in Moodle has an open redirect vulnerability that allows remote attackers to redirect users to arbitrary websites.

The generate_password function in Moodle through 2.4.11, and in versions 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide a sufficient number of possible temporary passwords, allowing remote attackers to gain access via a brute-force attack.

In Moodle versions 2.x and 3.x, SQL injection vulnerability can occur via user preferences.

Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the core_grades_get_gradeitems web service that allows enrolled students to view hidden grade items. Authenticated course users can call the AJAX or mobile web service to list hidden grade item ids, names, and categories that the gradebook conceals from them.

Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain an information disclosure vulnerability in the core_grades_get_feedback web service. The service lacks group-membership and enrolment checks, so non-editing teachers can iterate userid values to read other groups' grade feedback and users' names and identity fields such as email.

Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injection vulnerability in the External database enrolment plugin via course idnumber. Editing teachers can store a backslash-quote payload in idnumber that executes during scheduled sync on MySQL/MariaDB external databases, reading data and manipulating enrolment results.

In Moodle, the XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. An attacker can trick an authenticated user with grade management permissions into visiting a malicious webpage, triggering unauthorized requests on the victim's behalf. This allows a remote attacker to set or overwrite student grades without authorization.

A flaw was found in Moodle where user list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure by inferring hidden user data.