The XML grade import functionality (which allows setting or overwriting of student grades) did not include the necessary token to prevent a CSRF risk.
Version checkMoodle 5.1.5
Moodle 5.1.5 5.1 is supported
Released 8 Jun 2026. The current 5.1 release is 5.1.7, published 14 Sep 2026.
12 security advisories since 5.1.5
Every one of them is fixed in 5.1.7, the current 5.1 release, 2 releases ahead of you. Upgrading within the branch is a minor update with no feature changes.
12
Advisories
4
Serious
8
Minor
0
Not fixed in 5.1
12
CVE pending
Group by
12 advisories, newest firstSerious4
An incorrect capability check in a grade web service allowed students to access profile information of other students enrolled in the same course, which they would not otherwise have access to.
An SQL injection risk was identified in a question bank web service.
Incorrect handling of IPv4-mapped IPv6 addresses could allow bypassing of some blocked hosts, resulting in an SSRF risk.
Minor8
User list filters allowed managers to filter by user profile fields that they could not view on users' profiles.
Insufficient username escaping could allow a minor XSS risk if an unauthenticated user was tricked into opening a password reset link (so did not affect authenticated user sessions).
MinorMSA-26-0038Enrolling user to course while selecting group does not validate group belongs to that course
A check to validate a group belonged to a course was missing, which made it possible for teachers to add users to groups in courses that the teacher could not otherwise access.
MinorMSA-26-0037Missing capability checks allow unauthorised triggering of grade penalty recalculation
Missing capability checks made it possible for users to trigger grade penalty recalculation without having the capability to do so.
An incorrect capability check in the AI "generate image" web service could allow users to access that feature without having the "generate image" capability.
The manual enrolment management page did not prevent direct access when the plugin was disabled and a link was no longer available in the UI. Note: This still required the relevant capability to access the page (had it been enabled).
Insufficient escaping resulted in an XSS risk in some templates used to display forum posts.
Insufficient validation of the audience classname in report builder allowed arbitrary class instantiation.
You are here: Moodle 5.1.5
Released 8 Jun 2026. Each release below closes the advisories listed under it.
Moodle 5.1.610 Aug 2026 · 12 advisories4 Serious8 Minor
MinorMSA-26-0040User list filters do not respect user profile field visibilityCVE pendingMDL-87518moodle.org
MinorMSA-26-0038Enrolling user to course while selecting group does not validate group belongs to that courseCVE pendingMDL-88538moodle.org
MinorMSA-26-0037Missing capability checks allow unauthorised triggering of grade penalty recalculationCVE pendingMDL-88585moodle.org
MinorMSA-26-0036Incorrect capability check in AI editor placement "generate image" serviceCVE pendingMDL-88587moodle.org
MinorMSA-26-0035Manual enrolment does not correctly observe disabled state of pluginCVE pendingMDL-88593moodle.org
MinorMSA-26-0033Arbitrary class instantiation via audience classname in core_reportbuilderCVE pendingMDL-89078moodle.org
SeriousMSA-26-0032User profile information disclosure via grade web serviceCVE pendingMDL-89381moodle.org
SeriousMSA-26-0030SSRF risk in URL downloader (bypass some blocked hosts)CVE pendingMDL-88779moodle.org
Moodle 5.1.714 Sep 2026 · No advisories publishedCurrent release
Moodle core is one half of the picture
Third-party plugins run with the same privileges as core and never appear in these advisories. MDL Shield reviews plugin code for exactly that gap.
Advisory titles and descriptions are Moodle's own words, from the security announcements on moodle.org, and every entry links to its source. This list is a lower bound: Moodle stops issuing advisories for a branch once it leaves security support. MDL Shield is an independent service and is not affiliated with or endorsed by Moodle Pty Ltd.