The XML grade import functionality (which allows setting or overwriting of student grades) did not include the necessary token to prevent a CSRF risk.
Version checkMoodle 4.5.12
Moodle 4.5.12 4.5 is supportedLTS
Released 8 Jun 2026. The current 4.5 release is 4.5.14, published 14 Sep 2026.
10 security advisories since 4.5.12
Every one of them is fixed in 4.5.14, the current 4.5 release, 2 releases ahead of you. Upgrading within the branch is a minor update with no feature changes.
10
Advisories
4
Serious
6
Minor
0
Not fixed in 4.5
10
CVE pending
Group by
10 advisories, newest firstSerious4
An incorrect capability check in a grade web service allowed students to access profile information of other students enrolled in the same course, which they would not otherwise have access to.
An SQL injection risk was identified in a question bank web service.
Incorrect handling of IPv4-mapped IPv6 addresses could allow bypassing of some blocked hosts, resulting in an SSRF risk.
Minor6
User list filters allowed managers to filter by user profile fields that they could not view on users' profiles.
Insufficient username escaping could allow a minor XSS risk if an unauthenticated user was tricked into opening a password reset link (so did not affect authenticated user sessions).
An incorrect capability check in the AI "generate image" web service could allow users to access that feature without having the "generate image" capability.
The manual enrolment management page did not prevent direct access when the plugin was disabled and a link was no longer available in the UI. Note: This still required the relevant capability to access the page (had it been enabled).
Insufficient escaping resulted in an XSS risk in some templates used to display forum posts.
Insufficient validation of the audience classname in report builder allowed arbitrary class instantiation.
You are here: Moodle 4.5.12
Released 8 Jun 2026. Each release below closes the advisories listed under it.
Moodle 4.5.1310 Aug 2026 · 10 advisories4 Serious6 Minor
MinorMSA-26-0040User list filters do not respect user profile field visibilityCVE pendingMDL-87518moodle.org
MinorMSA-26-0036Incorrect capability check in AI editor placement "generate image" serviceCVE pendingMDL-88587moodle.org
MinorMSA-26-0035Manual enrolment does not correctly observe disabled state of pluginCVE pendingMDL-88593moodle.org
MinorMSA-26-0033Arbitrary class instantiation via audience classname in core_reportbuilderCVE pendingMDL-89078moodle.org
SeriousMSA-26-0032User profile information disclosure via grade web serviceCVE pendingMDL-89381moodle.org
SeriousMSA-26-0030SSRF risk in URL downloader (bypass some blocked hosts)CVE pendingMDL-88779moodle.org
Moodle 4.5.1414 Sep 2026 · No advisories publishedCurrent release
Moodle core is one half of the picture
Third-party plugins run with the same privileges as core and never appear in these advisories. MDL Shield reviews plugin code for exactly that gap.
Advisory titles and descriptions are Moodle's own words, from the security announcements on moodle.org, and every entry links to its source. This list is a lower bound: Moodle stops issuing advisories for a branch once it leaves security support. MDL Shield is an independent service and is not affiliated with or endorsed by Moodle Pty Ltd.