CVE-2026-102580
An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation.
Does this matter?
Lower severity and a low EPSS score (0.24%). Track it; it rarely justifies an emergency change on its own.
Description
A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected application behavior.
- CVSS 3.1
- 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- EPSS
- 0.24% probability · 14th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-470
- Affected
- moodle/moodle
- Source
- patrick@puiterwijk.org
EPSS moved from 0.2% on 30 September 2026 to 0.2% on 26 October 2026.
References
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-89078Patch
- https://access.redhat.com/security/cve/CVE-2026-102580Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2543635Issue Tracking, Third Party Advisory
- https://moodle.org/mod/forum/discuss.php?d=482498Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.