{"id":"CVE-2026-119556","kind":"vulnerability","aliases":["CVE-2026-119556"],"related":[],"title":"Moodle: enrolled students can list hidden gradebook items via web service","description":"Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the core_grades_get_gradeitems web service that allows enrolled students to view hidden grade items. Authenticated course users can call the AJAX or mobile web service to list hidden grade item ids, names, and categories that the gradebook conceals from them.","summary":"Moodle's core_grades_get_gradeitems web service is missing a capability check, so enrolled students can see hidden grade item ids, names and categories. An attacker gets gradebook metadata the course hides from them, not the grades themselves as stated in the description.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["education","moodle","runtime","self-hosted"],"not_affected_if":["unaffected-version"],"how_to_check":"- Check the Moodle version under Site administration > Notifications or in version.php against the affected ranges\n- Confirm whether the web service is enabled for students on your site (Site administration > Server > Web services)","fix":"- Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4 and 5.3.0 are affected; the sources do not state the fixed version","status":"open","published_at":"2026-10-30T12:16:42+00:00","first_seen_at":"2026-10-30T12:30:26+00:00","triaged_at":"2026-10-30T12:32:56+00:00","updated_at":"2026-10-30T12:32:56+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-30T12:32:56Z","model":"claude-haiku-5-5","output":{"fix":"- Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4 and 5.3.0 are affected; the sources do not state the fixed version","reach":"network","title":"Moodle: enrolled students can list hidden gradebook items via web service","impact":"low","summary":"Moodle's core_grades_get_gradeitems web service is missing a capability check, so enrolled students can see hidden grade item ids, names and categories. An attacker gets gradebook metadata the course hides from them, not the grades themselves as stated in the description.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["moodle","self-hosted","education"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"enrolled students list hidden grade item names and categories","analyst_note":"Find the fixed Moodle versions and confirm whether the web service is on by default, from the NVD entry or the Moodle security announcement.","how_to_check":"- Check the Moodle version under Site administration > Notifications or in version.php against the affected ranges\n- Confirm whether the web service is enabled for students on your site (Site administration > Server > Web services)","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Sites running an affected Moodle release where students are enrolled in courses and can call the grades web service (AJAX or mobile app). Sites on versions outside the listed ranges are not affected. The sources do not say whether disabling the web service for students fully removes exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000726,"input_tokens":4225,"output_tokens":606,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119556':14A,17A '-2026':13A,16A '4.2.0':69C '4.5.15':71C '5.0.0':72C '5.0.11':74C '5.1.0':75C '5.1.8':77C '5.2.0':78C '5.2.4':80C '5.3.0':82C 'ajax':111C 'allow':97C 'attack':50B 'authent':105C 'call':109C 'capabl':35B,86C 'categori':48B,124C 'check':36B,87C 'conceal':128C 'contain':83C 'core':26B,90C 'cours':55B,106C 'cve':12A,15A 'descript':67B 'educ':18B 'enrol':2A,38B,98C 'get':28B,51B,92C 'grade':27B,43B,61B,91C,103C,119C 'gradebook':7A,52B,127C 'gradeitem':29B,93C 'hidden':6A,42B,102C,118C 'hide':56B 'host':23B 'id':45B,121C 'item':8A,44B,104C,120C 'list':5A,117C 'metadata':53B 'miss':33B,85C 'mobil':113C 'moodl':1A,19B,24B,68C 'name':46B,122C 'runtim':20B 'see':41B 'self':22B 'self-host':21B 'servic':11A,31B,95C,115C 'state':64B 'student':3A,39B,99C 'user':107C 'via':9A 'view':101C 'web':10A,30B,94C,114C","nicknames":[],"mitigations":[],"who_affected":"Sites running an affected Moodle release where students are enrolled in courses and can call the grades web service (AJAX or mobile app). Sites on versions outside the listed ranges are not affected. The sources do not say whether disabling the web service for students fully removes exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T12:16:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119556","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119556","severity":null,"published_at":"2026-10-30T12:16:42+00:00","modified_at":"2026-10-30T12:16:42+00:00","first_seen_at":"2026-10-30T12:30:26+00:00","fetched_at":"2026-10-30T12:30:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}