BIT-moodle-2026-102580

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102580.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-moodle-2026-102580
Aliases
Published
2026-10-05T11:55:24Z
Modified
2026-10-05T14:30:06Z
Summary
Moodle: arbitrary class instantiation via report builder audience classname
Details

A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected application behavior.

Database specific 
{
    "cpes":  [
        "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"
    ],
    "severity":  "Medium"
}
References

Affected packages

Bitnami / moodle

Package

Name
moodle
Purl
pkg:bitnami/moodle

Severity

  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.5.13
Introduced
5.0.0
Fixed
5.0.9
Introduced
5.1.0
Fixed
5.1.6
Introduced
5.2.0
Fixed
5.2.2

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2026-102580.json"