CVE-2026-113607 Configurable Reports block for Moodle before 5.3.0 Authorization Bypass via get_report_data
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-113607?
CVE-2026-113607 is a high-severity vulnerability in jleyva moodle-block_configurablereports, published on 20 Oct 2026.
Official description
Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the block_configurable_reports_get_report_data web service. When check_permissions fails, the function only adds a warning and still returns the full report table, letting any logged-in user supply arbitrary report ids to read SQL reports over user and grade data.
Weakness: CWE-863
Which versions are affected by CVE-2026-113607?
How do I fix CVE-2026-113607?
No fix has been published for CVE-2026-113607 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-113607 being exploited?
There is no known exploitation of CVE-2026-113607 in the wild and no public exploit code.
Sources
Also known as GHSA-7v7c-h53q-gqrm.