CVE-2026-58336

Overview

Moodle is an open source learning management system written in PHP. Schools, universities, and companies use it to run online courses. IOMAD is a multi-tenant distribution of Moodle that lets one installation serve several companies or organizations; it is built on Moodle core and shares the affected code. Several parts of Moodle, such as blog entries, glossary and database entries, and assignment submissions, can carry comments. The comments API adds, lists, and deletes them through comment/comment_ajax.php.

An Insecure Direct Object Reference (IDOR) vulnerability (CVE-2026-58336) has been identified in the comments API of Moodle and IOMAD, which allows a user who may delete comments in one context, such as an editing teacher in their own course, to delete any comment on the site by its ID. Moodle tracks this issue as MSA-26-0017 (MDL-88619).

Per MITRE CWE-639: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

This issue affects all versions of Moodle before 4.5.12, versions 5.0.0 through 5.0.7, versions 5.1.0 through 5.1.4, and version 5.2.0, including End-of-Life release lines such as Moodle 4.3. IOMAD releases built on these Moodle versions contain the same code and are affected as well.

Details

Module Info

• Product: Moodle, IOMAD
• Affected packages: moodle/moodle (comment/comment_ajax.php)
• Affected versions: <4.5.12, >=5.0.0 <5.0.8, >=5.1.0 <5.1.5, >=5.2.0 <5.2.1
• GitHub repository: https://github.com/moodle/moodle (Moodle), https://github.com/iomad/iomad (IOMAD)
• Published packages: https://packagist.org/packages/moodle/moodle
• Package manager: Composer
• Fixed in:
  • OSS Moodle 4.5.12, 5.0.8, 5.1.5, 5.2.1
  • NES for Moodle v4.3.13
  • NES for IOMAD v4.3.4

Vulnerability Info

This High-severity vulnerability is found in the moodle/moodle package in all versions before 4.5.12, 5.0.0 through 5.0.7, 5.1.0 through 5.1.4, and 5.2.0 of Moodle, and in IOMAD releases built on those versions. Moodle rates it Serious.

Each request to comment/comment_ajax.php names a context, component, comment area, and item, and the script builds a comment manager for that location. Permission checks run against that location. For a delete, the script loaded the comment by the ID in the request and asked the manager whether the user could delete it:

    case 'delete':
        $comment = $DB->get_record('comments', ['id' => $commentid]);
        if ($manager->can_delete($comment)) {
            if ($manager->delete($commentid)) {

The query matched only on id, so the comment did not have to belong to the context, component, area, or item the manager was built for. comment::can_delete() then checked the capability in the manager's context, not in the comment's own context:

        $hascapability = has_capability('moodle/comment:delete', $this->context);
        $owncomment = $USER->id == $comment->userid;

        return ($hascapability || ($owncomment && $this->can_post()));

A user with moodle/comment:delete in any context could therefore point the request at a location where they hold the capability and pass the ID of a comment from anywhere else. comment::delete() repeats the same check and then removes the row by ID. By default, editing teachers and managers have moodle/comment:delete, so an editing teacher in one course can delete comments in other courses and in areas outside any course. Comment IDs are sequential, so they are easy to enumerate. The flaw allows deletion only; the response does not return the content of the deleted comment. Sites with comments turned off (usecomments) are not exposed, because the script refuses all requests in that case.

The fix loads the comment only when it matches the context, component, comment area, and item that the request names, and refuses the deletion when there is no match:

    case 'delete':
        $comment = $DB->get_record('comments', [
            'id' => $commentid,
            'contextid' => $context->id,
            'component' => $component,
            'commentarea' => $area,
            'itemid' => $itemid,
        ]);
        if (!empty($comment) && $manager->can_delete($comment)) {

Mitigation

Moodle publishes security fixes only for its supported release lines. Earlier release lines, including Moodle 4.3 and the IOMAD releases built on it, are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, sites can turn off comments with Enable comments (usecomments) under Site administration > Advanced features, or remove moodle/comment:delete from roles that do not need it.

Users of the affected components should apply one of the following mitigations:

• Upgrade to Moodle 4.5.12, 5.0.8, 5.1.5, 5.2.1, or later, or to an IOMAD release built on one of those versions.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Paul Holden from Moodle HQ (finder)