A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile at…

Low CVSS 2.7

CVECVE-2026-102587

First seen2026-10-01 15:16 UTC

Disclosed2026-09-30 09:17 UTC

Last updated2026-10-01 15:16 UTC

Channel statusauto

Summary

A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure by inferring hidden user data.

In-depth triage

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Affected products

Sources

NVD DATABASE

Original Links

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-87518 Patch
https://access.redhat.com/security/cve/CVE-2026-102587 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2543642 Issue Tracking
https://moodle.org/mod/forum/discuss.php?d=482506 Vendor Advisory

Timeline

2026-10-01 nvd_ingest NVD