CVE-2020-1754Medium· 4.3▾ SunlitIn Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, users viewing the grade history report without the 'access all groups' capability were not restricted to viewing grades of users within their own groups.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.6%
0.6% → 0.7%
In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, users viewing the grade history report without the 'access all groups' capability were not restricted to viewing grades of users within their own groups.
moodle >= 3.5.0, < 3.5.11moodle >= 3.6.0, < 3.6.9moodle >= 3.7.0, < 3.7.5moodle = 3.8.0moodle = 3.8.1Upgrade past the affected range:
moodle 3.7.5Connected by shared product, vendor, weakness, or advisory.
CVE-2026-102581Medium· 4.6A flaw was found in Moodle
CVE-2026-102579Medium· 4.3A flaw was found in Moodle
CVE-2026-102577Medium· 4.3A flaw was found in Moodle
CVE-2026-102578Medium· 5.5A flaw was found in Moodle
CVE-2026-102585Medium· 4.3A flaw was found in Moodle
CVE-2026-102582Low· 2.2A flaw was found in Moodle