Description
A flaw was found in Moodle. The actions to enable and disable group messaging did not include the necessary token to prevent a Cross-Site Request Forgery (CSRF) risk. A remote attacker could exploit this by tricking an authenticated user into performing unintended actions, potentially leading to unauthorized changes in group messaging settings.
Published: n/a
Score: 3.5 Low
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Jul 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Moodle
Moodle moodle
Vendors & Products Moodle
Moodle moodle

Tue, 28 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Description A flaw was found in Moodle. The actions to enable and disable group messaging did not include the necessary token to prevent a Cross-Site Request Forgery (CSRF) risk. A remote attacker could exploit this by tricking an authenticated user into performing unintended actions, potentially leading to unauthorized changes in group messaging settings.
Title moodle: CSRF risk in group messaging state toggle
Weaknesses CWE-22
References
Metrics threat_severity

None

 cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N'}

threat_severity

Moderate

Subscriptions

Moodle Moodle
cve-icon MITRE

No data.

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-28T11:04:58Z

Links: CVE-2026-58341 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-28T18:30:04Z

Weaknesses