CVE-2026-102585

A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses they do not have authorization to access.

Database specific

{
    "cna_assigner":  "fedora",
    "cwe_ids":  [
        "CWE-842"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102585.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "5.2.0"
                },
                {
                    "fixed":  "5.2.2"
                },
                {
                    "introduced":  "5.1.0"
                },
                {
                    "fixed":  "5.1.6"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/moodle/moodle

Affected ranges

Type

GIT

Repo

https://github.com/moodle/moodle

Events

Introduced

eb47eff0719455a7e1f7a9805bc75dad3f6b3995

Fixed

17513f6614237b530de7903fe32117fa026384c2

Introduced

c197f31fd89bf5dd5ba41661b06660167e419099

Fixed

acfa383c13dd46c83ca82894a8e95fac273fda33

Database specific

Show details

{
    "cpe":  "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "5.1.0"
        },
        {
            "fixed":  "5.1.6"
        },
        {
            "introduced":  "5.2.0"
        },
        {
            "fixed":  "5.2.2"
        }
    ],
    "source":  "CPE_RANGE"
}

Affected versions

v5.*

v5.1.0

v5.1.1

v5.1.2

v5.1.3

v5.1.4

v5.1.5

v5.2.0

v5.2.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102585.json"