CVE-2026-102588: Moodle

Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days.

A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthorized requests on the victim's behalf. This flaw allows a remote attacker to set or overwrite student grades without authorization.

Affected products

• Moodle Moodle: before 4.5.13 (fixed in 4.5.13); from 5.0.0, before 5.0.9 (fixed in 5.0.9); from 5.1.0, before 5.1.6 (fixed in 5.1.6); from 5.2.0, before 5.2.2 (fixed in 5.2.2)

Published 2026-09-30. Last modified 2026-10-01.