{"id":"CVE-2026-124834","kind":"vulnerability","aliases":["CVE-2026-124834"],"related":[],"title":"iomad: stored temporary passwords can be disclosed remotely by attacker","description":"A security vulnerability has been detected in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this issue is the function store_temporary_password of the file public/local/iomad/classes/company_user.php of the component Password Field Handler. Such manipulation leads to information disclosure. The attack may be performed from remote. The attack requires a high level of complexity. The exploitation is known to be difficult. The name of the patch is 0d9c0ccaa8a77583f5dd92eb7be7fbbb8cc6ec9b/9c740fd254fd12d56d7be3b85ac5e9fb4f8c03d8/33755cdd551a84be423b1eaf784d405c1988dbad/7fcf9b52c539a67f3e46a8da6b42ab1d1f26295b. It is advisable to implement a patch to correct this issue. This CVE was requested by the vendor.","summary":"iomad, a Moodle-based learning platform for businesses, stores temporary user passwords in a way that an attacker can read from a remote position, per the NVD entry. Exploitation is described as high complexity and difficult, and the attacker gets information disclosure rather than code execution.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["iomad","lms","moodle","runtime","self-hosted"],"not_affected_if":["fixed-version","not-iomad"],"how_to_check":"- Check the installed iomad version against the affected range up to `4.5.15`, `5.0.11`, `5.1.8` and `5.2.4`\n- Look for `store_temporary_password` in `public/local/iomad/classes/company_user.php`","fix":"- Apply the patch commits listed by the source (0d9c0ccaa8a77583f5dd92eb7be7fbbb8cc6ec9b, 9c740fd254fd12d56d7be3b85ac5e9fb4f8c03d8, 33755cdd551a84be423b1eaf784d405c1988dbad, 7fcf9b52c539a67f3e46a8da6b42ab1d1f26295b)\n- Fixed release version: unknown","status":"open","published_at":"2026-11-09T20:18:10+00:00","first_seen_at":"2026-11-09T20:48:13+00:00","triaged_at":"2026-11-09T20:49:50+00:00","updated_at":"2026-11-09T20:49:50+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-09T20:49:50Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the patch commits listed by the source (0d9c0ccaa8a77583f5dd92eb7be7fbbb8cc6ec9b, 9c740fd254fd12d56d7be3b85ac5e9fb4f8c03d8, 33755cdd551a84be423b1eaf784d405c1988dbad, 7fcf9b52c539a67f3e46a8da6b42ab1d1f26295b)\n- Fixed release version: unknown","reach":"internet","title":"iomad: stored temporary passwords can be disclosed remotely by attacker","impact":"low","summary":"iomad, a Moodle-based learning platform for businesses, stores temporary user passwords in a way that an attacker can read from a remote position, per the NVD entry. Exploitation is described as high complexity and difficult, and the attacker gets information disclosure rather than code execution.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["iomad","moodle","self-hosted","lms"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"remote attacker reads temporary passwords stored by the application","analyst_note":"Confirm the fixed release version for each branch from the iomad project or the patch commits; sources list only commit hashes.","how_to_check":"- Check the installed iomad version against the affected range up to `4.5.15`, `5.0.11`, `5.1.8` and `5.2.4`\n- Look for `store_temporary_password` in `public/local/iomad/classes/company_user.php`","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-iomad","fixed-version"],"who_is_affected":"Organisations running iomad, the Moodle-based learning management system, in the affected version ranges are exposed. The flaw sits in the company user code that handles temporary passwords, so sites that do not use iomad's company user features are not affected. Sites on versions newer than the listed ranges can skip it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000835,"input_tokens":4771,"output_tokens":716,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124834':13A,16A '-2026':12A,15A '/5.0.11/5.1.8/5.2.4':82C '0d9c0ccaa8a77583f5dd92eb7be7fbbb8cc6ec9b/9c740fd254fd12d56d7be3b85ac5e9fb4f8c03d8/33755cdd551a84be423b1eaf784d405c1988dbad/7fcf9b52c539a67f3e46a8da6b42ab1d1f26295b':137C '4.5.15':81C 'advis':140C 'affect':83C 'attack':10A,42B,63B,110C,117C 'base':28B 'busi':32B 'code':69B 'complex':58B,123C 'compon':99C 'correct':146C 'cve':11A,14A,150C 'describ':55B 'detect':76C 'difficult':60B,130C 'disclos':7A 'disclosur':66B,108C 'entri':52B 'execut':70B 'exploit':53B,125C 'field':101C 'file':95C 'function':89C 'get':64B 'handler':102C 'high':57B,120C 'host':23B 'implement':142C 'inform':65B,107C 'iomad':1A,17B,24B,78C 'issu':86C,148C 'known':127C 'lead':105C 'learn':29B 'level':121C 'lms':18B 'manipul':104C 'may':111C 'moodl':19B,27B 'moodle-bas':26B 'name':132C 'nvd':51B 'password':4A,36B,92C,100C 'patch':135C,144C 'per':49B 'perform':113C 'platform':30B 'posit':48B 'public/local/iomad/classes/company_user.php':96C 'rather':67B 'read':44B 'remot':8A,47B,115C 'request':152C 'requir':118C 'runtim':20B 'secur':72C 'self':22B 'self-host':21B 'store':2A,33B,90C 'temporari':3A,34B,91C 'user':35B 'vendor':155C 'vulner':73C 'way':39B","nicknames":[],"mitigations":[],"who_affected":"Organisations running iomad, the Moodle-based learning management system, in the affected version ranges are exposed. The flaw sits in the company user code that handles temporary passwords, so sites that do not use iomad's company user features are not affected. Sites on versions newer than the listed ranges can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["iomad","lms","medium","moodle","runtime","selfhosted"],"campaign_type":null,"search_a":"'-124834':13A,16A '-2026':12A,15A 'attack':10A 'cve':11A,14A 'disclos':7A 'iomad':1A 'password':4A 'remot':8A 'store':2A 'temporari':3A","search_b":"'attack':42B,63B 'base':28B 'busi':32B 'code':69B 'complex':58B 'describ':55B 'difficult':60B 'disclosur':66B 'entri':52B 'execut':70B 'exploit':53B 'get':64B 'high':57B 'host':23B 'inform':65B 'iomad':17B,24B 'learn':29B 'lms':18B 'moodl':19B,27B 'moodle-bas':26B 'nvd':51B 'password':36B 'per':49B 'platform':30B 'posit':48B 'rather':67B 'read':44B 'remot':47B 'runtim':20B 'self':22B 'self-host':21B 'store':33B 'temporari':34B 'user':35B 'way':39B","search_c":"'/5.0.11/5.1.8/5.2.4':82C '0d9c0ccaa8a77583f5dd92eb7be7fbbb8cc6ec9b/9c740fd254fd12d56d7be3b85ac5e9fb4f8c03d8/33755cdd551a84be423b1eaf784d405c1988dbad/7fcf9b52c539a67f3e46a8da6b42ab1d1f26295b':137C '4.5.15':81C 'advis':140C 'affect':83C 'attack':110C,117C 'complex':123C 'compon':99C 'correct':146C 'cve':150C 'detect':76C 'difficult':130C 'disclosur':108C 'exploit':125C 'field':101C 'file':95C 'function':89C 'handler':102C 'high':120C 'implement':142C 'inform':107C 'iomad':78C 'issu':86C,148C 'known':127C 'lead':105C 'level':121C 'manipul':104C 'may':111C 'name':132C 'password':92C,100C 'patch':135C,144C 'perform':113C 'public/local/iomad/classes/company_user.php':96C 'remot':115C 'request':152C 'requir':118C 'secur':72C 'store':90C 'temporari':91C 'vendor':155C 'vulner':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T20:18:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124834","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124834","severity":null,"published_at":"2026-11-09T20:18:10+00:00","modified_at":"2026-11-09T20:18:10+00:00","first_seen_at":"2026-11-09T20:48:13+00:00","fetched_at":"2026-11-09T20:48:13+00:00","note":null}],"documents":[{"id":109713,"url":"https://github.com/iomad/iomad/commit/7fcf9b52c539a67f3e46a8da6b42ab1d1f26295b","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}