CVE-2026-102588

Name of the Vulnerable Software and Affected Versions Moodle (affected versions not specified)

Description The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. CSRF is a flaw that allows an attacker to trick an authenticated user into performing actions they did not intend to. By inducing a user with grade management permissions to visit a malicious webpage, a remote attacker can trigger unauthorized requests to set or overwrite student grades.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.