Bug 2543635 (CVE-2026-102580)

Summary: CVE-2026-102580 moodle: Arbitrary class instantiation via report builder audience classname
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected application behavior.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2543836    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-29 20:36:22 UTC 
A flaw was found in Moodle's report builder (core_reportbuilder). Insufficient validation of the audience classname allowed arbitrary class instantiation. No exploitable gadget chain leading to a stronger impact (e.g. code execution or data disclosure) has been demonstrated; the flaw is treated here as instantiation of an arbitrary class with no confirmed further primitive.