CVE-2026-58337

Overview

Moodle is an open source learning management system written in PHP. Schools, universities, and companies use it to run online courses. IOMAD is a multi-tenant distribution of Moodle that lets one installation serve several companies or organizations; it is built on Moodle core and shares the affected code. When an administrator sets the default home page to User preference, each user can choose whether the site home page or the Dashboard is their home page with a Make this my home page link.

A Cross-Site Request Forgery (CSRF) vulnerability (CVE-2026-58337) has been identified in the home page preference setting of Moodle and IOMAD, which allows an attacker to change a logged-in user's home page preference by getting that user to open a crafted link. Moodle tracks this issue as MSA-26-0018 (MDL-88609).

Per OWASP: Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated. With a little help of social engineering (such as sending a link via email or chat), an attacker may trick the users of a web application into executing actions of the attacker's choosing.

This issue affects all versions of Moodle before 4.5.12, versions 5.0.0 through 5.0.7, versions 5.1.0 through 5.1.4, and version 5.2.0, including End-of-Life release lines such as Moodle 4.3. IOMAD releases built on these Moodle versions contain the same code and are affected as well.

Details

Module Info

• Product: Moodle, IOMAD
• Affected packages: moodle/moodle (index.php, my/index.php)
• Affected versions: <4.5.12, >=5.0.0 <5.0.8, >=5.1.0 <5.1.5, >=5.2.0 <5.2.1
• GitHub repository: https://github.com/moodle/moodle (Moodle), https://github.com/iomad/iomad (IOMAD)
• Published packages: https://packagist.org/packages/moodle/moodle
• Package manager: Composer
• Fixed in:
  • OSS Moodle 4.5.12, 5.0.8, 5.1.5, 5.2.1
  • NES for Moodle v4.3.13
  • NES for IOMAD v4.3.4

Vulnerability Info

This Low-severity vulnerability is found in the moodle/moodle package in all versions before 4.5.12, 5.0.0 through 5.0.7, 5.1.0 through 5.1.4, and 5.2.0 of Moodle, and in IOMAD releases built on those versions. Moodle rates it Minor.

Moodle protects state-changing requests with a per-session token, the sesskey, and checks it with require_sesskey() or confirm_sesskey(). The Make this my home page link points to /?setdefaulthome=1 on the site home page and to /my/?setdefaulthome=1 on the Dashboard. Both pages saved the preference as soon as that parameter was present, without checking a token. In index.php:

$homepage = get_home_page();
if ($homepage != HOMEPAGE_SITE) {
    if (optional_param('setdefaulthome', false, PARAM_BOOL)) {
        set_user_preference('user_home_page_preference', HOMEPAGE_SITE);

and in my/index.php:

if (get_home_page() != HOMEPAGE_MY) {
    if (optional_param('setdefaulthome', false, PARAM_BOOL)) {
        set_user_preference('user_home_page_preference', HOMEPAGE_MY);

Because the request needed no token, any page or message could send it on the user's behalf. A logged-in user who opens one of these URLs, or loads a page that requests it in the background, has their user_home_page_preference switched to the site home page or the Dashboard. get_home_page() reads that preference only when the site's default home page is set to User preference, so the change has an effect only on those sites. Guest users are skipped on the Dashboard path.

The impact is limited to which page the user lands on after login. The request does not expose data or change accounts, permissions, or course content.

The fix requires a valid session token before the preference is saved, redirects back to the page afterwards, and adds the token to both Make this my home page links:

if (optional_param('setdefaulthome', false, PARAM_BOOL) && confirm_sesskey()) {
    set_user_preference('user_home_page_preference', HOMEPAGE_SITE);
    redirect($PAGE->url);

Mitigation

Moodle publishes security fixes only for its supported release lines. Earlier release lines, including Moodle 4.3 and the IOMAD releases built on it, are End-of-Life and will not receive any public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to Moodle 4.5.12, 5.0.8, 5.1.5, 5.2.1, or later, or to an IOMAD release built on one of those versions.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Paul Holden from Moodle HQ (finder)