CVE-2026-102580

Summary

A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected application behavior.

Affected Software

VendorProductVersion RangeStatus
5.2.0 < 5.2.2affected
5.1.0 < 5.1.6affected
5.0.0 < 5.0.9affected
0 < 4.5.13affected

Weaknesses

  • CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References