CVE-2026-58341

Overview

Moodle is an open source learning management system written in PHP. Schools, universities, and companies use it to run online courses. IOMAD is a multi-tenant distribution of Moodle that lets one installation serve several companies or organizations; it is built on Moodle core and shares the affected code. Teachers manage course groups on the Groups page, where they can select groups and turn group messaging on or off. When messaging is enabled for a group, Moodle creates or enables a group conversation for its members.

A Cross-Site Request Forgery (CSRF) vulnerability (CVE-2026-58341) has been identified in the course groups page of Moodle and IOMAD, which allows an attacker to enable or disable messaging for a course's groups by getting a logged-in teacher to open a crafted link. Moodle tracks this issue as MSA-26-0022 (MDL-88541).

Per OWASP: Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated. With a little help of social engineering (such as sending a link via email or chat), an attacker may trick the users of a web application into executing actions of the attacker's choosing.

This issue affects all versions of Moodle before 4.5.12, versions 5.0.0 through 5.0.7, versions 5.1.0 through 5.1.4, and version 5.2.0, including End-of-Life release lines such as Moodle 4.3. IOMAD releases built on these Moodle versions contain the same code and are affected as well.

Details

Module Info

• Product: Moodle, IOMAD
• Affected packages: moodle/moodle (group/index.php)
• Affected versions: <4.5.12, >=5.0.0 <5.0.8, >=5.1.0 <5.1.5, >=5.2.0 <5.2.1
• GitHub repository: https://github.com/moodle/moodle (Moodle), https://github.com/iomad/iomad (IOMAD)
• Published packages: https://packagist.org/packages/moodle/moodle
• Package manager: Composer
• Fixed in:
  • OSS Moodle 4.5.12, 5.0.8, 5.1.5, 5.2.1
  • NES for Moodle v4.3.13
  • NES for IOMAD v4.3.4

Vulnerability Info

This Low-severity vulnerability is found in the moodle/moodle package in all versions before 4.5.12, 5.0.0 through 5.0.7, 5.1.0 through 5.1.4, and 5.2.0 of Moodle, and in IOMAD releases built on those versions. Moodle rates it Minor.

Moodle protects state-changing requests with a per-session token, the sesskey, and checks it with require_sesskey() or confirm_sesskey(). The enablemessaging and disablemessaging actions in group/index.php changed the selected groups based only on the action and groups[] request parameters, and the groups form did not include a token:

case 'enablemessaging':
    set_groups_messaging($groupids, true);
    redirect($returnurl, get_string('messagingenabled', 'group', count($groupids)), null,
        \core\output\notification::NOTIFY_SUCCESS);
    break;

case 'disablemessaging':
    set_groups_messaging($groupids, false);
    redirect($returnurl, get_string('messagingdisabled', 'group', count($groupids)), null,
        \core\output\notification::NOTIFY_SUCCESS);
    break;

Because the request needed no token, any page or message could send it on a teacher's behalf. A teacher who opens a crafted URL for /group/index.php with the course ID, the action, and one or more group IDs, or loads a page that requests it in the background, turns group messaging on or off for those groups. set_groups_messaging() saves the change through groups_update_group(), which enables or disables the group's conversation.

The page requires the moodle/course:managegroups capability, which the editing teacher and manager archetypes have by default, so the victim must be able to manage groups in the course. The impact is limited to whether group members can use the group conversation. The request does not expose messages or change group membership.

The fix calls require_sesskey() in both actions and adds a hidden sesskey field to the groups form in the index template:

case 'enablemessaging':
    require_sesskey();
    set_groups_messaging($groupids, true);
    redirect($returnurl, get_string('messagingenabled', 'group', count($groupids)), null,
        \core\output\notification::NOTIFY_SUCCESS);
    break;

Mitigation

Moodle publishes security fixes only for its supported release lines. Earlier release lines, including Moodle 4.3 and the IOMAD releases built on it, are End-of-Life and will not receive any public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to Moodle 4.5.12, 5.0.8, 5.1.5, 5.2.1, or later, or to an IOMAD release built on one of those versions.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Paul Holden from Moodle HQ (finder)