Description
Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the core_grades_get_gradeitems web service that allows enrolled students to view hidden grade items. Authenticated course users can call the AJAX or mobile web service to list hidden grade item ids, names, and categories that the gradebook conceals from them.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Moodle Project | moodle | 5.3.0, 5.2.0 – ≤ 5.2.4, 5.1.0 – ≤ 5.1.8, 5.0.0 – ≤ 5.0.11, 4.2.0 – ≤ 4.5.15 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | moodle | No fix yet | — |
| Ubuntu Pro 16.04 LTS | moodle | No fix yet | — |
Advisories 1
- WID-SEC-2026-4274 Moodle: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 1, 2026
References
- https://github.com/moodle/moodle/blob/v5.3.0/public/grade/classes/external/get_gradeitems.php#L74-L80 technical-description
- https://abraxaslabs.tech/research/moodle-grades-gradeitems third-party-advisory
- https://github.com/moodle/moodle product
- VulnCheck Advisory: Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Missing Authorization via core_grades_get_gradeitems third-party-advisory