CVE-2026-113607
Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read re
CVSS
6.5
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Oct 20, 2026 · Last modified: Oct 20, 2026 · CWE-863
Not enough EPSS history yet.
Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the block_configurable_reports_get_report_data web service. When check_permissions fails, the function only adds a warning and still returns the full report table, letting any logged-in user supply arbitrary report ids to read SQL reports over user and grade data.
- github.comhttps://github.com/jleyva/moodle-block_configurablereports/blob/5.2.0/classes/external.php#L95-L99
- github.comhttps://github.com/jleyva/moodle-block_configurablereports/commit/4a0e6eadf7bdb6fa52ef71141bdf120cd68e6abc
- github.comhttps://github.com/jleyva/moodle-block_configurablereports/releases/tag/5.3.0
- www.vulncheck.comhttps://www.vulncheck.com/advisories/configurable-reports-block-for-moodle-before-5.3.0-authorization-bypass-via-get-report-data
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1123809.9 CRI—
———Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's other agent sessions and execute arbitrary commands on the host running Kiro Crew via messages sent to the group.
To remediate this issue, users should upgrade to version 0.7.2.6hCVE-2026-1136705.3 MED—
———ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the core page REST API reads full page documents with .permission(false) in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: private, and visibility: loginRequired checks. Unauthenticated visitors and low-privilege contributors can read admin-only and non-public page content by _id/slug. This issue is fixed in version 4.33.0.7hCVE-2026-925396.7 MED—
———A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.7hCVE-2026-283288.8 HIG—
———SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions.7hCVE-2026-113653——
———ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, viewRole is not applied to anonymous visitors when a developer exposes user objects through a publicly rendered relationship or expressly enabled public API. Inadequately limited templates, including serialization of an entire related user object, can conditionally disclose user fields, but relationships do not automatically publish full user objects and password hashes are stored separately and are not affected. This issue is fixed in version 4.33.0.7hCVE-2026-1136764.3 MED—
———Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists, resource limits, notes, and login history.10h