The XML grade import functionality (which allows setting or overwriting of student grades) did not include the necessary token to prevent a CSRF risk.
Version checkMoodle 4.5.11
Moodle 4.5.11 4.5 is supportedLTS
Released 20 Apr 2026. The current 4.5 release is 4.5.14, published 14 Sep 2026.
27 security advisories since 4.5.11
Every one of them is fixed in 4.5.14, the current 4.5 release, 3 releases ahead of you. Upgrading within the branch is a minor update with no feature changes.
27
Advisories
12
Serious
15
Minor
0
Not fixed in 4.5
10
CVE pending
Group by
27 advisories, newest firstSerious12
An incorrect capability check in a grade web service allowed students to access profile information of other students enrolled in the same course, which they would not otherwise have access to.
An SQL injection risk was identified in a question bank web service.
Incorrect handling of IPv4-mapped IPv6 addresses could allow bypassing of some blocked hosts, resulting in an SSRF risk.
User profile descriptions for authenticated users posed a denial of service risk due to the absence of a defined maximum length.
Insufficient capability checks in the Assignment module's marker allocation functionality allowed users without the required capability to allocate markers to submissions.
The regrade action in the quiz overview report did not include the necessary token to prevent a CSRF risk.
The grade item ID number editing functionality did not include the necessary token to prevent a CSRF risk and also lacked sufficient output sanitizing to prevent an XSS risk.
A remote code execution risk was identified in the admin presets import feature. Note: This feature is only available to site administrators.
An arbitrary file read risk was identified in the backup restore functionality.
A flaw in email-based multi-factor authentication made it possible for a user to bypass another user's MFA token check if using the email factor. Note: Valid login credentials (such as username and password) were still required to log into the account.
An arbitrary file read risk was identified in the Database Activity module's import feature.
Minor15
User list filters allowed managers to filter by user profile fields that they could not view on users' profiles.
Insufficient username escaping could allow a minor XSS risk if an unauthenticated user was tricked into opening a password reset link (so did not affect authenticated user sessions).
An incorrect capability check in the AI "generate image" web service could allow users to access that feature without having the "generate image" capability.
The manual enrolment management page did not prevent direct access when the plugin was disabled and a link was no longer available in the UI. Note: This still required the relevant capability to access the page (had it been enabled).
Insufficient escaping resulted in an XSS risk in some templates used to display forum posts.
Insufficient validation of the audience classname in report builder allowed arbitrary class instantiation.
The report builder fragment output callbacks did not verify that the requesting user had the required capability to access the requested report, potentially allowing users to retrieve report data beyond their permitted access.
A blind SSRF risk was identified in the MNet peers management functionality, due to missing validation of peer hostnames against the cURL blocked hosts configuration. Note: This feature is only available to site administrators.
Capability checks were missing from course assistance AI placement web services, which could allow users to make requests to those AI course assistance web services without having the relevant capabilities (if those features are enabled).
The quiz feature to add section headings did not include the necessary token to prevent a CSRF risk.
The actions to enable and disable group messaging did not include the necessary token to prevent a CSRF risk.
The Feedback activity module's import functionality required additional sanitizing to prevent a reflected XSS risk.
The user profile page reset action did not include the necessary token to prevent a CSRF risk.
The setting for users to set their own homepage preference did not include the necessary token to prevent a CSRF risk.
Missing group access checks in some grade web services could allow a user to access grade and user information for students in groups they did not have permission to view.
You are here: Moodle 4.5.11
Released 20 Apr 2026. Each release below closes the advisories listed under it.
Moodle 4.5.128 Jun 2026 · 17 advisories8 Serious9 Minor
MinorMSA-26-0029Missing capability checks in report builder fragment callbacksCVE-2026-58348MDL-84535moodle.org
SeriousMSA-26-0026Missing capability check in Assignment marker allocationCVE-2026-58345MDL-88529moodle.org
MinorMSA-26-0024Missing capability checks in AI placement web servicesCVE-2026-58343MDL-88533moodle.org
SeriousMSA-26-0012Arbitrary file read risk in Database activity moduleCVE-2026-58331MDL-88595moodle.org
Moodle 4.5.1310 Aug 2026 · 10 advisories4 Serious6 Minor
MinorMSA-26-0040User list filters do not respect user profile field visibilityCVE pendingMDL-87518moodle.org
MinorMSA-26-0036Incorrect capability check in AI editor placement "generate image" serviceCVE pendingMDL-88587moodle.org
MinorMSA-26-0035Manual enrolment does not correctly observe disabled state of pluginCVE pendingMDL-88593moodle.org
MinorMSA-26-0033Arbitrary class instantiation via audience classname in core_reportbuilderCVE pendingMDL-89078moodle.org
SeriousMSA-26-0032User profile information disclosure via grade web serviceCVE pendingMDL-89381moodle.org
SeriousMSA-26-0030SSRF risk in URL downloader (bypass some blocked hosts)CVE pendingMDL-88779moodle.org
Moodle 4.5.1414 Sep 2026 · No advisories publishedCurrent release
Moodle core is one half of the picture
Third-party plugins run with the same privileges as core and never appear in these advisories. MDL Shield reviews plugin code for exactly that gap.
Advisory titles and descriptions are Moodle's own words, from the security announcements on moodle.org, and every entry links to its source. This list is a lower bound: Moodle stops issuing advisories for a branch once it leaves security support. MDL Shield is an independent service and is not affiliated with or endorsed by Moodle Pty Ltd.