CVE-2026-102583

LowCVSS 2.7/10Last modified Oct 1, 2026

Description

A flaw was found in Moodle. An incorrect capability check in the artificial intelligence (AI) editor placement's image generation web service allows an authenticated user to invoke the feature without holding the required capability. This flaw permits unauthorized users to access and utilize the AI image generation functionality.

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-425

Affected software

No affected versions have been published.

Timeline

Published: Sep 30, 2026
Last modified: Oct 1, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1025844.3A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade pe CVE-2026-1025854.3A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the CVE-2026-1025866.1A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cro CVE-2026-1025872.7A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user wit CVE-2026-1025886.5A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an aut CVE-2026-102598.8A security vulnerability has been detected in H3C Magic B0 up to 100R002. The affected element is the function SetMobileAPInfoById of the fi CVE-2026-1025964.3Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9, on accounts with RBAC enabled thro CVE-2026-1025986.3Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safe_join function used by send_from_directory can allow a NUL CVE-2026-1025997.5Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can CVE-2026-102607.3A vulnerability was detected in CodeAstro Online Job Portal 1.0. The impacted element is an unknown function of the file /admin/jobs-admins/CVE-2026-1026007.5Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited o CVE-2026-1026013.5Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormali