Moodle: user list filters bypass profile field visibility
A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure by inferring hidden user data.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-102587US | — | — | ||
A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lis… | ||||
02
references
External citations — patches, advisories, analysis.
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-87518FIX
- https://access.redhat.com/security/cve/CVE-2026-102587ADVISORY
- https://bugzilla.redhat.com/show_bug.cgi?id=2543642ADVISORY
- https://moodle.org/mod/forum/discuss.php?d=482506ADVISORY
- https://nvd.nist.gov/vuln/detail/CVE-2026-102587WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan