A flaw was found in Moodle's report builder (core_reportbuilder). Insufficient validation of the audience classname allowed arbitrary class instantiation. No exploitable gadget chain leading to a stronger impact (e.g. code execution or data disclosure) has been demonstrated; the flaw is treated here as instantiation of an arbitrary class with no confirmed further primitive.