Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Missing Authorization via core_grades_get_gradeitems

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the core_grades_get_gradeitems web service that allows enrolled students to view hidden grade items. Authenticated course users can call the AJAX or mobile web service to list hidden grade item ids, names, and categories that the gradebook conceals from them.

Etkilenen sürümler1 yazılım

Kaynaklar6 kaynak

• CVE.org kaydı
• NVD kaydı
• abraxaslabs.tech/research/moodle-grades-gradeitems Üçüncü taraf
• vulncheck.com/…g-authorization-via-core-grades-get-gradeitems Üçüncü taraf
• github.com/…blic/grade/classes/external/get_gradeitems.php Diğer
• github.com/moodle/moodle Diğer

Kayıt geçmişi

1. 30 Eki 2026 14:31Yayımlandı

İlgili açıklar

• 4,3 CVE-2026-119555Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Information Disclosure via core_grades_get_feedback
• 5,9 CVE-2026-119554Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 SQL Injection via enrol_database Course idnumber
• 6,5 CVE-2026-119553Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Blackboard Import Path Traversal
• 3,5 CVE-2026-119550Jellyfin through 12.4 Information Disclosure via GET /Playlists/{playlistId}
• 6,5 CVE-2026-119551Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions
• 7,5 CVE-2026-110732AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.8.6 - Missing Authorization to Administrator Account T…