CVE-2026-102578 is a Medium (CVSS 5.5) SQL injection in Moodle. An authenticated attacker with access to the question bank web service can pass unsanitized input into database queries, which could expose or change data. Check the Moodle announcement for fixed versions, then update.
What's affected
The weakness is CWE-89 (SQL injection). The record describes it as a flaw in Moodle where an authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries. This could allow viewing, altering or deleting sensitive data in the underlying database.
The CVSS 3.1 vector is network, low complexity, high privileges required, no user interaction, with high impact on confidentiality and low on integrity. The high privilege requirement is the main reason the score is Medium. A user who can call this web service already has elevated rights.
We could not confirm affected or fixed Moodle versions. The record lists the Moodle forum announcement, a code commit search for the tracker issue MDL-89383, a Red Hat page and a Red Hat bug. Moodle's site returned a browser check when we tried to read the announcement, and the Red Hat data did not give a fixed version for Moodle. So this post does not list versions. Please check the Moodle security announcement and the tracker issue for the exact releases.
How to check if you're exposed
Find your Moodle version. In the site administration area, open Site administration, then Notifications, which shows the version. You can also read the version file in the code directory.
grep -E "release|version" /var/www/moodle/version.php
Compare it with the releases in the Moodle announcement.
Then check who has access to web services. Web services in Moodle are enabled per site, and a service token is tied to a user. Review which services are enabled, who holds tokens, and which roles can use the question bank related functions. The record says high privileges are required, so the people to look at are teachers with wide rights, managers and administrators, along with any service accounts.
The free in-browser dependency scan at gold.safeguard.sh/scan can match a lockfile or manifest against known CVEs without installing anything. The Gold directory page for each CVE lists affected packages and fixes as they are published.
What to do now
- Read the Moodle security announcement and the MDL-89383 tracker entry for the fixed versions.
- Update Moodle to the fixed release for your branch.
- Review enabled web services and revoke tokens that are unused.
- Reduce the number of accounts that hold high privileges and web service access.
- Take a database backup before updating, and keep it for the update window.
Why it matters
SQL injection happens when user supplied text is placed into a query as code and not as data. The usual defence is parameterised queries. Moodle has a database API that does this, and the flaw is a place where input reached a query without it.
The attacker must already hold high privileges, which limits who can use it. In a learning platform, that group can still be large, and the database holds student records. The record does not mark the CVE as known exploited.
Quick check
Why is it only Medium when it is SQL injection?
The vector requires high privileges, which lowers the score. The impact on confidentiality is still rated high.
Which versions are fixed?
We could not confirm them. Check the Moodle security announcement and issue MDL-89383.
Sources
- Moodle security announcement (listed in the record, blocked by a browser check when we tried)
- Red Hat CVE page
Last reviewed: 18 October 2026.
