medium6.5
CVE-2026-102588
A flaw was found in Moodle.
Impact
A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthorized requests on the victim's behalf. This flaw allows a remote attacker to set or overwrite student grades without authorization.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Moodle | Moodle | before 4.5.13 from 5.0.0 before 5.0.9 from 5.1.0 before 5.1.6 from 5.2.0 before 5.2.2 |