CVE-2015-5266: Moodle

Medium severity, CVSS 6.8. EPSS: 1.6% chance of exploitation in the next 30 days.

The enrol_meta_sync function in enrol/meta/locallib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to obtain manager privileges in opportunistic circumstances by leveraging incorrect role processing during a long-running sync script.

Affected products

• Moodle Moodle: up to and including 2.6.11; version 2.7.0 only; version 2.7.1 only; version 2.7.2 only; version 2.7.3 only; version 2.7.4 only; …

Published 2016-02-22. Last modified 2026-06-17.