CVE-2026-119556— Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Missing Authorization via core_grades_get_gradeitems

Quick assessment

Affected

Moodle Project moodle

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Moodle 4.2.0 至 4.5.15、5.0.0 至 5.0.11、5.1.0 至 5.1.8、5.2.0 至 5.2.4 以及 5.3.0 版本中，核心 Web 服务缺少权限检查（capability check），导致已注册的学生能够查看被隐藏的评分项目。已认证的课程用户可通过 AJAX 或移动 Web 服务调用该接口，获取本应被成绩簿隐藏的分项目 ID、名称及分类信息。

CVSS 4.3 · Medium Updated Oct 30, 2026

Possible ATT&CK Techniques 2 AI

T1086 T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Missing Authorization via core_grades_get_gradeitems

Source: CVE Program / CVE List V5

Vulnerability Description

Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the core_grades_get_gradeitems web service that allows enrolled students to view hidden grade items. Authenticated course users can call the AJAX or mobile web service to list hidden grade item ids, names, and categories that the gradebook conceals from them.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Moodle Project	moodle	5.3.0	-

II. Public POCs for CVE-2026-119556

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119556

请登录查看更多情报信息。

Other References for CVE-2026-119556 (4)

https://github.com/moodle/moodle/blob/v5.3.0/public/grade/classes/external/get_gradeitems.php#L74-L80 technical-description
https://github.com/moodle/moodle product
https://abraxaslabs.tech/research/moodle-grades-gradeitems third-party-advisory
https://www.vulncheck.com/advisories/moodle-through-5.3.0-5.2.4-5.1.8-5.0.11-and-4.5.15-missing-authorization-via-core-grades-get-gradeitems third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119556

Same Patch Batch · Moodle Project · 2026-10-30 · 4 CVEs total

CVE-2026-119553	6.5 MEDIUM	Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Blackboard Import Path Traversal
CVE-2026-119554	5.9 MEDIUM	Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 SQL Injection via enrol_database Cou
CVE-2026-119555	4.3 MEDIUM	Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Information Disclosure via core_grad

IV. Related Vulnerabilities

Same product: moodle

Same vendor: Moodle Project

Same weakness: CWE-862