Bug 2507971

Summary: CVE-2026-58337 moodle: CSRF risk in user homepage preference setting [fedora-all]
Product: [Fedora] Fedora Reporter: Dhananjay Arunesh <darunesh>
Component: moodleAssignee: Gwyn Ciesla <gwync>
Status: CLOSED CURRENTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: rawhideCC: gwync, igor.raits
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["0da15c5a-b09e-40f1-b038-7cf88e51ef5a"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-07-28 18:21:05 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2494822    

Description Dhananjay Arunesh 2026-07-28 11:15:00 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

MSA-26-0018: CSRF risk in user homepage preference setting

Description:       The setting for users to set their own homepage preference
did not include the necessary token to prevent a CSRF risk.
Issue summary:     CSRF risk in user homepage preference setting
Severity/Risk:     Minor
Versions affected: 5.2, 5.1 to 5.1.4, 5.0 to 5.0.7, 4.5 to 4.5.11 and earlier
unsupported versions
Versions fixed:    5.2.1, 5.1.5, 5.0.8 and 4.5.12
Reported by:       Paul Holden
Issue no.:         MDL-88609