by Michael Hawkins. The grade penalty rules reset function did not include the necessary token to prevent a CSRF risk. Severity/Risk: Minor Versions affected: 5.1 to 5.1.3 and 5.0 to 5.0.6 Versions fixed: 5.1.4 and 5.0.7 Reported by: Khải nguyễn Đặng CVE identifier: CVE-2026-7277 Changes (main): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88087 Tracker issue: MDL-88087 CSRF risk in reset penalty rules functionality