{"id":"CVE-2026-119555","kind":"vulnerability","aliases":["CVE-2026-119555"],"related":[],"title":"Moodle: grade feedback web service leaks other groups' data to teachers","description":"Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain an information disclosure vulnerability in the core_grades_get_feedback web service. The service lacks group-membership and enrolment checks, so non-editing teachers can iterate userid values to read other groups' grade feedback and users' names and identity fields such as email.","summary":"The core_grades_get_feedback web service in Moodle skips group-membership and enrolment checks. A non-editing teacher can iterate userid values to read other groups' grade feedback and users' names and email addresses.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["education","moodle","runtime","self-hosted"],"not_affected_if":["version-outside-range","web-service-disabled"],"how_to_check":"- Check the Moodle version under Site administration > Server > Environment or in the version.php file, and compare it with the affected ranges.\n- Review whether the web services for grades are enabled for teacher roles on the site.","fix":"- Upgrade to a fixed Moodle release in the affected ranges; the exact fixed versions are unknown from the sources.","status":"open","published_at":"2026-10-30T12:16:42+00:00","first_seen_at":"2026-10-30T12:30:26+00:00","triaged_at":"2026-10-30T12:32:56+00:00","updated_at":"2026-10-30T12:32:56+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-30T12:32:56Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to a fixed Moodle release in the affected ranges; the exact fixed versions are unknown from the sources.","reach":"network","title":"Moodle: grade feedback web service leaks other groups' data to teachers","impact":"medium","summary":"The core_grades_get_feedback web service in Moodle skips group-membership and enrolment checks. A non-editing teacher can iterate userid values to read other groups' grade feedback and users' names and email addresses.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["moodle","education","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Teacher reads other groups' grade feedback and users' email addresses","analyst_note":"","how_to_check":"- Check the Moodle version under Site administration > Server > Environment or in the version.php file, and compare it with the affected ranges.\n- Review whether the web services for grades are enabled for teacher roles on the site.","plain_action":"","needs_analyst":false,"not_affected_if":["version-outside-range","web-service-disabled"],"who_is_affected":"Moodle sites running 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, or 5.3.0 are exposed. The attacker must be a logged-in non-editing teacher who can call the grade feedback web service. Sites without such users or without the web service exposed are less at risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000705,"input_tokens":4220,"output_tokens":565,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119555':14A,17A '-2026':13A,16A '4.2.0':62C '4.5.15':64C '5.0.0':65C '5.0.11':67C '5.1.0':68C '5.1.8':70C '5.2.0':71C '5.2.4':73C '5.3.0':75C 'address':60B 'check':39B,97C 'contain':76C 'core':25B,83C 'cve':12A,15A 'data':9A 'disclosur':79C 'edit':43B,101C 'educ':18B 'email':59B,121C 'enrol':38B,96C 'feedback':3A,28B,54B,86C,112C 'field':118C 'get':27B,85C 'grade':2A,26B,53B,84C,111C 'group':8A,35B,52B,93C,110C 'group-membership':34B,92C 'host':23B 'ident':117C 'inform':78C 'iter':46B,104C 'lack':91C 'leak':6A 'membership':36B,94C 'moodl':1A,19B,32B,61C 'name':57B,115C 'non':42B,100C 'non-edit':41B,99C 'read':50B,108C 'runtim':20B 'self':22B 'self-host':21B 'servic':5A,30B,88C,90C 'skip':33B 'teacher':11A,44B,102C 'user':56B,114C 'userid':47B,105C 'valu':48B,106C 'vulner':80C 'web':4A,29B,87C","nicknames":[],"mitigations":[],"who_affected":"Moodle sites running 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, or 5.3.0 are exposed. The attacker must be a logged-in non-editing teacher who can call the grade feedback web service. Sites without such users or without the web service exposed are less at risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T12:16:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119555","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119555","severity":null,"published_at":"2026-10-30T12:16:42+00:00","modified_at":"2026-10-30T12:16:42+00:00","first_seen_at":"2026-10-30T12:30:26+00:00","fetched_at":"2026-10-30T12:30:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}