Bug 2494836 (CVE-2026-58348)

Summary:	CVE-2026-58348 moodle: Missing capability checks in report builder fragment callbacks
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Moodle. Missing capability checks in the report builder fragment callbacks could allow authenticated users to retrieve report data that they are not authorized to access. This could lead to information disclosure.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2507957
Bug Blocks:
Deadline:	2026-07-01

Description OSIDB Bzimport 2026-06-30 10:39:19 UTC

MSA-26-0029: Missing capability checks in report builder fragment callbacks

Description:       The report builder fragment output callbacks did not verify
that the requesting user had the required capability to
access the requested report, potentially allowing users to
retrieve report data beyond their permitted access.
Issue summary:     Missing capability checks in report builder fragment
callbacks
Severity/Risk:     Minor
Versions affected: 5.2, 5.1 to 5.1.4, 5.0 to 5.0.7, 4.5 to 4.5.11 and earlier
unsupported versions
Versions fixed:    5.2.1, 5.1.5, 5.0.8 and 4.5.12
Reported by:       Paul Holden
Issue no.:         MDL-84535