---
id: "CVE-2026-119556"
kind: "vulnerability"
aliases: ["CVE-2026-119556"]
title: "Moodle: enrolled students can list hidden gradebook items via web service"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["education", "moodle", "runtime", "self-hosted"]
not_affected_if: ["unaffected-version"]
published_at: "2026-10-30T12:16:42+00:00"
first_seen_at: "2026-10-30T12:30:26+00:00"
updated_at: "2026-10-30T12:32:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119556", "first_seen_at": "2026-10-30T12:30:26+00:00"}]
---

# Moodle: enrolled students can list hidden gradebook items via web service

Moodle's core_grades_get_gradeitems web service is missing a capability check, so enrolled students can see hidden grade item ids, names and categories. An attacker gets gradebook metadata the course hides from them, not the grades themselves as stated in the description.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Moodle version under Site administration > Notifications or in version.php against the affected ranges
- Confirm whether the web service is enabled for students on your site (Site administration > Server > Web services)

## Fix

- Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4 and 5.3.0 are affected; the sources do not state the fixed version

## Timeline

- 2026-10-30T12:30:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119556

## From the sources

Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the core_grades_get_gradeitems web service that allows enrolled students to view hidden grade items. Authenticated course users can call the AJAX or mobile web service to list hidden grade item ids, names, and categories that the gradebook conceals from them.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_