CVE-2026-30884

Awaiting Analysis
Published: 18 Mar 2026, 02:26
Last modified:18 Mar 2026, 02:26

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.6 CRITICAL
v3.1 (cve.org)
EPSS Score
0.02% LOW
0% probability
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

18 Mar 2026, 02:26
Published
Vulnerability first disclosed

Description

mdjnelson/moodle-mod_customcert is a Moodle plugin for creating dynamically generated certificates with complete customization via the web browser. Prior to versions 4.4.9 and 5.0.3, a teacher who holds `mod/customcert:manage` in any single course can read and silently overwrite certificate elements belonging to any other course in the Moodle installation. The `core_get_fragment` callback `editelement` and the `mod_customcert_save_element` web service both fail to verify that the supplied `elementid` belongs to the authorized context, enabling cross-course information disclosure and data tampering. Versions 4.4.9 and 5.0.3 fix the issue.

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

EPSS Trends

Current EPSS score: 0.02%• Percentile: 3%

Techniques & Countermeasures

  • CWE-639•Authorization Bypass Through User-Controlled Key

    The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Affected Systems

  • mdjnelson•moodle-mod_customcert

    < 4.4.9 | ≥ 5.0.0, < 5.0.3

References (3)