---
id: CVE-2026-119556
title: >-
  Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Missing Authorization
  via core_grades_get_gradeitems
summary: >-
  Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0
  through 5.2.4, and 5.3.0 contain a missing capability check in the
  core_grades_get_gradeitems web service that allows enrolled students to view
  hidden grade it…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: Moodle Project
product: moodle
affected:
  - moodle 5.3.0
  - moodle >= 5.2.0 <= 5.2.4
  - moodle >= 5.1.0 <= 5.1.8
  - moodle >= 5.0.0 <= 5.0.11
  - moodle >= 4.2.0 <= 4.5.15
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T15:21:06.367380Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T15:54:25.966Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119556'
references:
  - url: >-
      https://github.com/moodle/moodle/blob/v5.3.0/public/grade/classes/external/get_gradeitems.php#L74-L80
  - url: 'https://abraxaslabs.tech/research/moodle-grades-gradeitems'
  - url: 'https://github.com/moodle/moodle'
  - url: >-
      https://www.vulncheck.com/advisories/moodle-through-5.3.0-5.2.4-5.1.8-5.0.11-and-4.5.15-missing-authorization-via-core-grades-get-gradeitems
    label: >-
      VulnCheck Advisory: Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15
      Missing Authorization via core_grades_get_gradeitems
tags:
  - cve.org
epss: 0.00285
epssPercentile: 0.21193
ingestedAt: '2026-11-05T16:07:30.520Z'
---

## Overview

Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the core_grades_get_gradeitems web service that allows enrolled students to view hidden grade items. Authenticated course users can call the AJAX or mobile web service to list hidden grade item ids, names, and categories that the gradebook conceals from them.

## Affected

- `moodle 5.3.0`
- `moodle >= 5.2.0 <= 5.2.4`
- `moodle >= 5.1.0 <= 5.1.8`
- `moodle >= 5.0.0 <= 5.0.11`
- `moodle >= 4.2.0 <= 4.5.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.