CVE-2026-7278

Overview

Moodle is an open source learning management system written in PHP. Schools, universities, and companies use it to run online courses. IOMAD is a multi-tenant distribution of Moodle that lets one installation serve several companies or organizations; it is built on Moodle core and shares the affected code. MNet (Moodle Networking) connects a Moodle site to other Moodle or Mahara sites, called peers. The Manage peers page includes a Register all hosts setting, also called promiscuous mode, which adds any MNet site that connects and requests the site's public key to the hosts list automatically.

A Cross-Site Request Forgery (CSRF) vulnerability (CVE-2026-7278) has been identified in the MNet peers page of Moodle and IOMAD, which allows anyone who can send a request to the page, or get a logged-in user to open a crafted link, to turn the Register all hosts setting on or off. Moodle tracks this issue as MSA-26-0011 (MDL-84495).

Per OWASP: Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated. With a little help of social engineering (such as sending a link via email or chat), an attacker may trick the users of a web application into executing actions of the attacker's choosing.

This issue affects all versions of Moodle before 4.5.11, versions 5.0.0 through 5.0.6, and versions 5.1.0 through 5.1.3, including End-of-Life release lines such as Moodle 4.3. IOMAD releases built on these Moodle versions contain the same code and are affected as well.

Details

Module Info

• Product: Moodle, IOMAD
• Affected packages: moodle/moodle (admin/mnet/peers.php)
• Affected versions: <4.5.11, >=5.0.0 <5.0.7, >=5.1.0 <5.1.4
• GitHub repository: https://github.com/moodle/moodle (Moodle), https://github.com/iomad/iomad (IOMAD)
• Published packages: https://packagist.org/packages/moodle/moodle
• Package manager: Composer
• Fixed in:
  • OSS Moodle 4.5.11, 5.0.7, 5.1.4
  • NES for Moodle v4.3.13
  • NES for IOMAD v4.3.4

Vulnerability Info

This Low-severity vulnerability is found in the moodle/moodle package in all versions before 4.5.11, 5.0.0 through 5.0.6, and 5.1.0 through 5.1.3 of Moodle, and in IOMAD releases built on those versions. Moodle rates it Minor.

Moodle admin pages call admin_externalpage_setup(), which requires the user to be logged in and to hold the capability the page needs, and they protect changes with the sesskey token. In admin/mnet/peers.php, the handler for the Register all hosts toggle ran before either of those checks:

$updra = optional_param('updateregisterall', 0, PARAM_INT);

// first process the register all hosts setting if required
if (!empty($updra)) {
    set_config('mnet_register_allhosts', optional_param('registerallhosts', 0, PARAM_INT));
    redirect(new moodle_url('/admin/mnet/peers.php'), get_string('changessaved'));
}

$adminsection = 'mnetpeers';
if ($hostid && $DB->get_field('mnet_host', 'deleted', array('id' => $hostid)) != 1) {
    $adminsection = 'mnetpeer' . $hostid;
}

$PAGE->set_url('/admin/mnet/peers.php');
admin_externalpage_setup($adminsection);

The setting was written and the request finished with a redirect before admin_externalpage_setup() was reached, and no sesskey was checked. A request such as /admin/mnet/peers.php?updateregisterall=1&registerallhosts=1 could therefore change the setting without any capability, and a crafted link or embedded request could make it happen through another user's browser.

With Register all hosts turned on, any MNet site that connects and requests the public key is added to the hosts list, and services enabled for All hosts become available to it. The setting is read only by the MNet XML-RPC server when a remote site asks to swap keys, so the change matters mainly on sites that have MNet networking turned on. An attacker can also turn the setting off, which stops new peers from being registered automatically on sites that rely on it.

The fix moves the handler after admin_externalpage_setup(), so the normal admin login and capability checks run first, and requires a valid sesskey before the setting is saved. The toggle button now includes the sesskey in its URL:

admin_externalpage_setup($adminsection);

if (!empty($updra) && confirm_sesskey()) {
    set_config('mnet_register_allhosts', optional_param('registerallhosts', 0, PARAM_INT));
    redirect(new moodle_url('/admin/mnet/peers.php'), get_string('changessaved'));
}

Mitigation

Moodle publishes security fixes only for its supported release lines. Earlier release lines, including Moodle 4.3 and the IOMAD releases built on it, are End-of-Life and will not receive any public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to Moodle 4.5.11, 5.0.7, 5.1.4, or later, or to an IOMAD release built on one of those versions.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Vincent Schneider (finder)