CVE-2026-102585

Publié : 30 septembre 2026

Modifié : 30 septembre 2026

Score CVSS

4.3

MEDIUM

Description détaillée

A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses they do not have authorization to access.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Références et Patchs

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88538 https://access.redhat.com/security/cve/CVE-2026-102585 https://bugzilla.redhat.com/show_bug.cgi?id=2543639 https://moodle.org/mod/forum/discuss.php?d=482503

Dernières Vulnérabilités

CVE-2026-97302

Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions.

VOIR DÉTAILS

CVE-2026-97301

Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions.

VOIR DÉTAILS

CVE-2026-97299

Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for WooCommerce <= 2.1.5 versions.

VOIR DÉTAILS