CVE-2026-102582

4.3 Moyenne

Publiée le 30/09/2026 à 11:17 · Modifiée le 01/10/2026 à 17:18 · Analysée par le NVD · Source : patrick@puiterwijk.org

Description

A flaw was found in Moodle. The manual enrolment management page did not properly check whether the manual enrolment plugin was disabled, allowing users with enrolment permissions to access the page directly by navigating to its URL. Consequently, an authorized user could manage manual enrolments even after an administrator disabled the feature in the user interface.

Traduire en français

Produits concernés

Moodle moodle

Scores CVSS

Version	Score	Source	Vecteur
3.1	2.2 Faible	patrick@puiterwijk.org	`CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N`
3.1	4.3 Moyenne	nvd@nist.gov (NVD)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N`

Faiblesses (CWE)

CWE-425

Références

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88593 Patch
https://access.redhat.com/security/cve/CVE-2026-102582 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2543636 Issue TrackingThird Party Advisory
https://moodle.org/mod/forum/discuss.php?d=482500 Vendor Advisory

CVE-2026-102582

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs