CVE-2026-7276

Overview

Moodle is an open source learning management system written in PHP. Schools, universities, and companies use it to run online courses. IOMAD is a multi-tenant distribution of Moodle that lets one installation serve several companies or organizations; it is built on Moodle core and shares the affected code. Moodle's messaging system lets users exchange private messages in one-to-one conversations, which they read through the message drawer and the messages page.

A Denial of Service (DoS) vulnerability (CVE-2026-7276) has been identified in the messaging API of Moodle and IOMAD, which can make the message panel fail to load for an active user who has a one-to-one conversation with a user whose account record no longer exists, so that the active user loses access to their private messages. Moodle tracks this issue as MSA-26-0007 (MDL-87760).

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others.

This issue affects all versions of Moodle before 4.5.11, versions 5.0.0 through 5.0.6, and versions 5.1.0 through 5.1.3, including End-of-Life release lines such as Moodle 4.3. IOMAD releases built on these Moodle versions contain the same code and are affected as well.

Details

Module Info

• Product: Moodle, IOMAD
• Affected packages: moodle/moodle (message/classes/api.php)
• Affected versions: <4.5.11, >=5.0.0 <5.0.7, >=5.1.0 <5.1.4
• GitHub repository: https://github.com/moodle/moodle (Moodle), https://github.com/iomad/iomad (IOMAD)
• Published packages: https://packagist.org/packages/moodle/moodle
• Package manager: Composer
• Fixed in:
  • OSS Moodle 4.5.11, 5.0.7, 5.1.4
  • NES for Moodle v4.3.13
  • NES for IOMAD v4.3.4

Vulnerability Info

This Low-severity vulnerability is found in the moodle/moodle package in all versions before 4.5.11, 5.0.0 through 5.0.6, and 5.1.0 through 5.1.3 of Moodle, and in IOMAD releases built on those versions. Moodle rates it Minor.

When Moodle lists a user's conversations, \core_message\api::get_conversations() and get_conversation() call can_send_message_to_conversation() for each conversation to decide whether the reply box should be enabled. For a one-to-one conversation, that method looks up the other member and checks whether the user may contact them:

} else if ($conversation->type == self::MESSAGE_CONVERSATION_TYPE_INDIVIDUAL) {
    // Get the other user in the conversation.
    $members = self::get_conversation_members($userid, $conversationid);
    $otheruser = array_filter($members, function($member) use($userid) {
        return $member->id != $userid;
    });
    $otheruser = reset($otheruser);

    return self::can_contact_user($otheruser->id, $userid);

get_conversation_members() builds its list from the user table, so a member whose user record no longer exists is left out. reset() on the empty array returns false, reading $otheruser->id yields null, and passing null to can_contact_user(), whose first parameter is declared as int, raises a TypeError. The error aborts the whole request, so one broken conversation stops the user's entire conversation list from loading.

The affected users are the remaining members of one-to-one conversations with an account whose record has been removed from the user table. They can lose access to all of their private messages until the site is patched. The flaw does not expose message content or let anyone send messages they otherwise could not, and group conversations and self-conversations are not affected, because the method returns before reaching this lookup for those types.

The fix returns false when the other member cannot be found or no longer has a user record, so the conversation is shown as one that cannot receive replies instead of breaking the panel:

$otheruser = reset($otheruser);
// Check if the user still exists in the system.
if (!$otheruser || !\core\user::is_real_user($otheruser->id, true)) {
    return false;
}

Mitigation

Moodle publishes security fixes only for its supported release lines. Earlier release lines, including Moodle 4.3 and the IOMAD releases built on it, are End-of-Life and will not receive any public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to Moodle 4.5.11, 5.0.7, 5.1.4, or later, or to an IOMAD release built on one of those versions.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Adam Jenkins (finder)