PT-2026-26023 · Mdjnelson · Moodle-Mod Customcert

Published 2026-03-18 · Updated 2026-03-18 · CVE-2026-30884

Mitre

CVSS v3.1

9.6

9.6

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

mdjnelson/moodle-mod customcert is a Moodle plugin for creating dynamically generated certificates with complete customization via the web browser. Prior to versions 4.4.9 and 5.0.3, a teacher who holds mod/customcert:manage in any single course can read and silently overwrite certificate elements belonging to any other course in the Moodle installation. The core get fragment callback editelement and the mod customcert save element web service both fail to verify that the supplied elementid belongs to the authorized context, enabling cross-course information disclosure and data tampering. Versions 4.4.9 and 5.0.3 fix the issue.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-30884

Affected Products

Moodle-Mod Customcert

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-30884 · Security Note
• https://github.com/mdjnelson/moodle-mod_customcert/commit/a1494a80fb953f187f7888a7394cbf9d13c28468 · Note
• https://github.com/mdjnelson/moodle-mod_customcert/security/advisories/GHSA-8pjr-j7r4-ccjx · Note
• https://github.com/mdjnelson/moodle-mod_customcert/commit/ddc8f01f1e19fb61202f6013a38ef757486d3ba0 · Note