MSA-26-0009: CSRF risk in reset penalty rules functionality

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-04-28 19:06 UTC
Importiert: 2026-06-22 14:40 UTC
Quelle-ID: moodle
uid_hash: 0b660bcdfcd1a7dc76c1e8b3d99848dee6de6a8a00488bd80aa6f6eaf59b14a1

Moodle Security Announcements

by Michael Hawkins.

The grade penalty rules reset function did not include the necessary token to prevent a CSRF risk.

Severity/Risk: Minor

Versions affected: 5.1 to 5.1.3 and 5.0 to 5.0.6

Versions fixed: 5.1.4 and 5.0.7

Reported by: Khải nguyễn Đặng

CVE identifier: CVE-2026-7277

Tracker issue: MDL-88087 CSRF risk in reset penalty rules functionality

CVE-ID	Severity (Quelle)	CVSS (Quelle)	Severity (CVE.org)	CVSS (CVE.org)	EPSS	EPSS-Pctl	Veroeffentlicht (CVE.org)
CVE-2026-7277

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
Moodle Security Announcements	moodle	vendor_advisory	cms	-	de	https://moodle.org/rss/file.php/154821/7ef1adaa0762dfdd7cd390868b6d9f2b/mod_forum/996/rss.xml