CVE-2026-102587: Moodle User List Filters Bypass Profile Field Visibility
Summary
CVE-2026-102587: Moodle: user list filters bypass profile field visibility. Affects moodle across 4 version ranges.
< 4.5.13
>= 5.0.0, < 5.0.9
>= 5.1.0, < 5.1.6
>= 5.2.0, < 5.2.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It offers a wide range of features including course management, user management, and various plugins to enhance functionality. However, it is susceptible to vulnerabilities that can lead to unauthorized access to sensitive information.
Vulnerability Detail
A flaw was found in Moodle where user list filters do not properly enforce visibility restrictions on user profile fields. This vulnerability allows an authorized user with manager privileges to filter user lists using profile attributes that they are not permitted to view directly. As a result, this can lead to unauthorized information disclosure by inferring hidden user data, potentially compromising user privacy and security.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.5.134.5.13 -
>= 5.0.0, < 5.0.95.0.9 -
>= 5.1.0, < 5.1.65.1.6 -
>= 5.2.0, < 5.2.25.2.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can restrict manager privileges to limit access to user profile fields until the patch is applied. This can be done by adjusting user roles and permissions in the Moodle administration settings.
Conclusion
CVE-2026-102587 represents a significant security concern for Moodle users, as it allows unauthorized access to hidden user data. It is crucial to apply the recommended updates to mitigate this risk and ensure the privacy and security of user information.
See every vulnerability recorded for moodle →
FAQ
CVE-2026-102587 is a vulnerability in Moodle that allows unauthorized users to access hidden user profile data through improper filtering of user list attributes.
Any Moodle installation that allows users with manager privileges to filter user lists is potentially affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider restricting manager privileges to limit access to sensitive user profile fields as a temporary measure.
You can find more information about Moodle vulnerabilities and security updates on the official Moodle website and GitHub repository.
Related vulnerabilities
Recent vulnerabilities recorded for moodle.
