Live › vulnerability › CVE-2026-113607
Go to dashboardThe Configurable Reports block for Moodle, before 5.3.0, returns full report data through a web service even when the permission check fails. Any logged-in user can supply arbitrary report ids and read SQL reports over user and grade data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Moodle sites that have the Configurable Reports block installed at a version before 5.3.0 and that expose the block_configurable_reports_get_report_data web service to logged-in users. Sites without the block, or where the web service is disabled or restricted, are less exposed; the sources do not say more.
No product ranges from the sources yet.
5.3.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the block_configurable_reports_get_report_data web service. When check_permissions fails, the function only adds a warning and still returns the full report table, letting any logged-in user supply arbitrary report ids to read SQL reports over user and grade data.
This page as .md · .json · in your agent: get_signal("CVE-2026-113607")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.