CVE-2026-119556 Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Missing Authorization via core_grades_get_gradeitems

Medium 5.3 Published 30 Oct 2026 Updated 30 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-119556?

CVE-2026-119556 is a medium-severity vulnerability in moodle, published on 30 Oct 2026.

Official description

Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the core_grades_get_gradeitems web service that allows enrolled students to view hidden grade items. Authenticated course users can call the AJAX or mobile web service to list hidden grade item ids, names, and categories that the gradebook conceals from them.

Weakness: CWE-862

Which versions are affected by CVE-2026-119556?

How do I fix CVE-2026-119556?

No fix has been published for CVE-2026-119556 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-119556 being exploited?

There is no known exploitation of CVE-2026-119556 in the wild and no public exploit code.

Sources

Also known as GHSA-cr99-f6rx-jfq5, UBUNTU-CVE-2026-119556.