{"id":"CVE-2026-113607","kind":"vulnerability","aliases":["CVE-2026-113607"],"related":[],"title":"Moodle Configurable Reports: authenticated users can read restricted reports","description":"Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the block_configurable_reports_get_report_data web service. When check_permissions fails, the function only adds a warning and still returns the full report table, letting any logged-in user supply arbitrary report ids to read SQL reports over user and grade data.","summary":"The Configurable Reports block for Moodle, before 5.3.0, returns full report data through a web service even when the permission check fails. Any logged-in user can supply arbitrary report ids and read SQL reports over user and grade data.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["lms","moodle","php","runtime","self-hosted"],"not_affected_if":["block-not-installed","web-service-disabled"],"how_to_check":"- Check the installed version of the Configurable Reports block (block_configurable_reports) in Moodle under Site administration > Plugins > Blocks; unknown if the sources give a specific version string to compare against\n- Look for the block_configurable_reports_get_report_data web service in Site administration > Server > Web services","fix":"- Update the Configurable Reports block to `5.3.0` or later\n- unknown whether a patch or workaround exists for earlier 5.x versions","status":"open","published_at":"2026-10-20T16:17:10+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:34:38+00:00","updated_at":"2026-10-25T03:34:38+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T03:34:38Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Configurable Reports block to `5.3.0` or later\n- unknown whether a patch or workaround exists for earlier 5.x versions","reach":"internet","title":"Moodle Configurable Reports: authenticated users can read restricted reports","impact":"medium","summary":"The Configurable Reports block for Moodle, before 5.3.0, returns full report data through a web service even when the permission check fails. Any logged-in user can supply arbitrary report ids and read SQL reports over user and grade data.","category":"runtime","nicknames":[],"who_cares":["moodle","lms","self-hosted","php"],"confidence":0.6,"needs_auth":"yes","worst_case":"Logged-in users read restricted SQL reports over user and grade data","analyst_note":"Confirm whether the web service is enabled by default and which Moodle versions ship the block; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-113607 for affected version ranges.","how_to_check":"- Check the installed version of the Configurable Reports block (block_configurable_reports) in Moodle under Site administration > Plugins > Blocks; unknown if the sources give a specific version string to compare against\n- Look for the block_configurable_reports_get_report_data web service in Site administration > Server > Web services","needs_analyst":true,"not_affected_if":["block-not-installed","web-service-disabled"],"who_is_affected":"Moodle sites that have the Configurable Reports block installed at a version before 5.3.0 and that expose the block_configurable_reports_get_report_data web service to logged-in users. Sites without the block, or where the web service is disabled or restricted, are less exposed; the sources do not say more.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000646,"input_tokens":3345,"output_tokens":623,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-113607':12A,15A '-2026':11A,14A '5.3.0':30B,70C 'add':101C 'allow':77C 'arbitrari':52B,118C 'authent':4A,78C 'author':73C 'block':26B,66C,86C 'bypass':74C 'check':43B,95C 'configur':2A,24B,64C,87C 'contain':71C 'cve':10A,13A 'data':34B,63B,91C,129C 'even':39B 'fail':44B,97C 'full':32B,108C 'function':99C 'get':89C 'grade':62B,128C 'host':22B 'id':54B,120C 'let':111C 'lms':16B 'log':47B,114C 'logged-in':46B,113C 'moodl':1A,17B,28B,68C 'permiss':42B,96C 'php':18B 'read':7A,56B,81C,122C 'report':3A,9A,25B,33B,53B,58B,65C,83C,88C,90C,109C,119C,124C 'restrict':8A,82C 'return':31B,106C 'runtim':19B 'self':21B 'self-host':20B 'servic':38B,93C 'sql':57B,123C 'still':105C 'suppli':51B,117C 'tabl':110C 'user':5A,49B,60B,79C,116C,126C 'vulner':75C 'warn':103C 'web':37B,92C","nicknames":[],"mitigations":[],"who_affected":"Moodle sites that have the Configurable Reports block installed at a version before 5.3.0 and that expose the block_configurable_reports_get_report_data web service to logged-in users. Sites without the block, or where the web service is disabled or restricted, are less exposed; the sources do not say more.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113607","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113607","severity":null,"published_at":"2026-10-20T16:17:10+00:00","modified_at":"2026-10-20T20:06:37+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}