CVE-2026-119556 Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Missing Authorization via core_grades_get_gradeitems

Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the coregradesgetgradeitems web service that allows enrolled students to view hidden grade items. Authenticated course users can call the AJAX or mobile web...

CVE-2026-119556 Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Missing Authorization via core_grades_get_gradeitems

Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the coregradesgetgradeitems web service that allows enrolled students to view hidden grade items. Authenticated course users can call the AJAX or mobile web...

EUVD-2026-113821

Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the coregradesgetgradeitems web service that allows enrolled students to view hidden grade items. Authenticated course users can call the AJAX or mobile web...

CVE-2026-119556

Moodle versions 4.2.0 through 4.5.15 , 5.0.0 through 5.0.11 , 5.1.0 through 5.1.8 , 5.2.0 through 5.2.4 , and 5.3.0 are vulnerable to a missing authorization flaw in the core_grades_get_gradeitems web service. The root cause is a lack of a capability check, which allows authenticated enrolled stu...