CVE-2026-30884

mdjnelson/moodle-mod_customcert is a Moodle plugin for creating dynamically generated certificates with complete customization via the web browser. Prior to versions 4.4.9 and 5.0.3, a teacher who holds `mod/customcert:manage` in any single course can read and silently overwrite certificate elements belonging to any other course in the Moodle installation. The `core_get_fragment` callback `editelement` and the `mod_customcert_save_element` web service both fail to verify that the supplied `elementid` belongs to the authorized context, enabling cross-course information disclosure and data tampering. Versions 4.4.9 and 5.0.3 fix the issue.

• CWE-639

• https://github.com/mdjnelson/moodle-mod_customcert/commit/a1494a80fb953f187f7888a7394cbf9d13c28468
• https://github.com/mdjnelson/moodle-mod_customcert/commit/ddc8f01f1e19fb61202f6013a38ef757486d3ba0
• https://github.com/mdjnelson/moodle-mod_customcert/security/advisories/GHSA-8pjr-j7r4-ccjx

Published

Mar 18, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-30879baserCMS is a website development framework. Prior to versio…6.1
• CVE-2026-3088Unauthenticated users on the local network can cause the rou…6.5
• CVE-2026-30880baserCMS is a website development framework. Prior to versio…9.8
• CVE-2026-30881Chamilo LMS is a learning management system. Version 1.11.34…8.8
• CVE-2026-30882Chamilo LMS is a learning management system. Chamilo LMS ver…6.1
• CVE-2026-30883ImageMagick is free and open-source software used for editin…7.8
• CVE-2026-30885WWBN AVideo is an open source video platform. Prior to 25.0,…5.3
• CVE-2026-30886New API is a large language mode (LLM) gateway and artificia…6.5
• CVE-2026-30887OneUptime is a solution for monitoring and managing online s…9.9
• CVE-2026-30888Discourse is an open-source discussion platform. Versions pr…5.5
• CVE-2026-30889Discourse is an open-source discussion platform. Prior to ve…4.9
• CVE-2026-3089Actual Sync Server allows authenticated users to upload file…6.5