CVE-2026-102588: Moodle XML Grade Import CSRF Vulnerability
Summary
CVE-2026-102588: Moodle: csrf in xml grade import. Affects moodle across 4 version ranges.
< 4.5.13
>= 5.0.0, < 5.0.9
>= 5.1.0, < 5.1.6
>= 5.2.0, < 5.2.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It supports various functionalities such as course management, grading, and user management. However, it has been found to be vulnerable to a Cross-Site Request Forgery (CSRF) attack in its XML grade import feature, which can lead to unauthorized grade modifications.
Vulnerability Detail
A flaw exists in Moodle's XML grade import functionality where it does not implement proper CSRF token validation. This vulnerability allows an attacker to trick an authenticated user with grade management permissions into visiting a malicious webpage. As a result, the attacker can execute unauthorized requests on behalf of the victim, potentially allowing them to set or overwrite student grades without proper authorization. This poses a significant risk to the integrity of the grading system within Moodle.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.5.134.5.13 -
>= 5.0.0, < 5.0.95.0.9 -
>= 5.1.0, < 5.1.65.1.6 -
>= 5.2.0, < 5.2.25.2.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can limit access to the XML grade import feature to trusted users only, ensuring that only those with legitimate permissions can access it. Additionally, implementing a web application firewall (WAF) may help mitigate the risk of CSRF attacks.
Conclusion
The CSRF vulnerability in Moodle's XML grade import feature poses a significant risk to the integrity of the grading system. It is crucial for users to update to the latest patched versions to mitigate this risk. By understanding the nature of this vulnerability and implementing the suggested fixes and workarounds, users can better protect their Moodle installations.
See every vulnerability recorded for moodle →
FAQ
A Cross-Site Request Forgery (CSRF) attack tricks a user into executing unwanted actions on a web application in which they are authenticated.
You can check if your application is affected by using Vulert's playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring access to the code.
If exploited, this vulnerability can allow unauthorized users to modify student grades, compromising the integrity of the educational system.
Yes, implementing CSRF tokens in forms and ensuring proper validation can help prevent such attacks.
It is recommended to regularly check for updates and apply them promptly to ensure that you have the latest security patches and features.
Related vulnerabilities
Recent vulnerabilities recorded for moodle.
