Live › vulnerability › CVE-2026-119556
Moodle's core_grades_get_gradeitems web service is missing a capability check, so enrolled students can see hidden grade item ids, names and categories. An attacker gets gradebook metadata the course hides from them, not the grades themselves as stated in the description.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Sites running an affected Moodle release where students are enrolled in courses and can call the grades web service (AJAX or mobile app). Sites on versions outside the listed ranges are not affected. The sources do not say whether disabling the web service for students fully removes exposure.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the core_grades_get_gradeitems web service that allows enrolled students to view hidden grade items. Authenticated course users can call the AJAX or mobile web service to list hidden grade item ids, names, and categories that the gradebook conceals from them.
This page as .md · .json · in your agent: get_signal("CVE-2026-119556")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.