---
id: CVE-2026-102583
title: A flaw was found in Moodle
summary: >-
  A flaw was found in Moodle. An incorrect capability check in the artificial
  intelligence (AI) editor placement's image generation web service allows an
  authenticated user to invoke the feature without holding the required
  capability. Thi…
severity: low
cvss: 2.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-425
vendor: moodle
product: moodle
affected:
  - moodle < 4.5.13
  - 'moodle >= 5.0.0, < 5.0.9'
  - 'moodle >= 5.1.0, < 5.1.6'
  - 'moodle >= 5.2.0, < 5.2.2'
patched:
  - moodle 5.2.2
published: '2026-09-30'
updated: '2026-10-01'
sourceUpdated: '2026-10-01T15:15:21.197'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102583'
references:
  - url: >-
      http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88587
    label: patrick@puiterwijk.org
  - url: 'https://access.redhat.com/security/cve/CVE-2026-102583'
    label: patrick@puiterwijk.org
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2543640'
    label: patrick@puiterwijk.org
  - url: 'https://moodle.org/mod/forum/discuss.php?d=482501'
    label: patrick@puiterwijk.org
tags:
  - nvd
  - cve.org
epss: 0.00241
epssPercentile: 0.15212
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-30T14:33:20.498442Z'
ingestedAt: '2026-09-30T09:00:29.908Z'
---

## Overview

A flaw was found in Moodle. An incorrect capability check in the artificial intelligence (AI) editor placement's image generation web service allows an authenticated user to invoke the feature without holding the required capability. This flaw permits unauthorized users to access and utilize the AI image generation functionality.

## Affected

- `moodle < 4.5.13`
- `moodle >= 5.0.0, < 5.0.9`
- `moodle >= 5.1.0, < 5.1.6`
- `moodle >= 5.2.0, < 5.2.2`

## Remediation

Upgrade past the affected range:

- `moodle 5.2.2`