CVE-2026-102587
An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure by inferring hidden user data.
Does this matter?
Lower severity and a low EPSS score (0.24%). Track it; it rarely justifies an emergency change on its own.
Description
A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure by inferring hidden user data.
- CVSS 3.1
- 2.7 LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 0.24% probability · 15th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-204
- Affected
- moodle/moodle
- Source
- patrick@puiterwijk.org
EPSS moved from 0.2% on 30 September 2026 to 0.2% on 26 October 2026.
References
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-87518Patch
- https://access.redhat.com/security/cve/CVE-2026-102587Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2543642Issue Tracking, Third Party Advisory
- https://moodle.org/mod/forum/discuss.php?d=482506Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.