CVE-2016-2156: calendar/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2...

Security readout for executives and security teams

This Moodle issue can let logged-in users see calendar event information for activities that should be hidden. It is an information disclosure problem, not evidence of system takeover. The business concern is exposure of embargoed course, activity, or operational details to authenticated users who should not see them. Exposure is most likely on older Moodle deployments in the listed affected ranges, especially where authenticated users can access the relevant web-service functionality. Public-facing Moodle portals with many student or contractor accounts have broader practical exposure. Treat this as a targeted confidentiality risk for legacy Moodle systems. Prioritize remediation where Moodle is internet-facing, has many authenticated users, or contains sensitive hidden course, assessment, or schedule information. Mitigation focus: Upgrade Moodle to a fixed version identified by the vendor advisory.; Move Moodle 2.6 deployments off the affected branch to a fixed supported release.; Review vendor guidance and the MDL-52808 change history before deployment..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.