CVE-2026-124834 · Runtime
NO FIX YET · SEE WHAT TO DO
iomad, a Moodle-based learning platform for businesses, stores temporary user passwords in a way that an attacker can read from a remote position, per the NVD entry. Exploitation is described as high complexity and difficult, and the attacker gets information disclosure rather than code execution.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organisations running iomad, the Moodle-based learning management system, in the affected version ranges are exposed. The flaw sits in the company user code that handles temporary passwords, so sites that do not use iomad's company user features are not affected. Sites on versions newer than the listed ranges can skip it.
Not affected if fixed-version, not-iomad
Who cares iomad, lms, moodle, self-hosted
4.5.15, 5.0.11, 5.1.8 and 5.2.4store_temporary_password in public/local/iomad/classes/company_user.phpA security vulnerability has been detected in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this issue is the function store_temporary_password of the file public/local/iomad/classes/company_user.php of the component Password Field Handler. Such manipulation leads to information disclosure. The attack may be performed from remote. The attack requires a high level of complexity. The exploitation is known to be difficult. The name of the patch is 0d9c0ccaa8a77583f5dd92eb7be7fbbb8cc6ec9b/9c740fd254fd12d56d7be3b85ac5e9fb4f8c03d8/33755cdd551a84be423b1eaf784d405c1988dbad/7fcf9b52c539a67f3e46a8da6b42ab1d1f26295b. It is advisable to implement a patch to correct this issue. This CVE was requested by the vendor.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.