CVE-2016-2158: lib/ajax/getnavbranch.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before...

Security readout for executives and security teams

CVE-2016-2158 is an information disclosure issue in Moodle navigation Ajax handling. Under the stated condition, a remote attacker using guest-role access could view sensitive category-detail information that should require login. The issue affects older Moodle branches listed in the CVE record. Exposure is most likely on legacy Moodle deployments in the named affected ranges, especially internet-facing sites with forcelogin enabled and guest access behavior still present. The bundle does not identify affected CPEs or hosting patterns. Prioritize remediation for internet-facing or sensitive Moodle sites still running the affected legacy versions. The business risk is unauthorized disclosure of course category details, not system takeover based on the provided evidence. Mitigation focus: Upgrade affected Moodle branches to the fixed versions named in the CVE or later.; For Moodle 2.6 deployments, check Moodle vendor guidance because no fixed 2.6 release is named.; Confirm forcelogin and guest-role settings align with current Moodle security guidance..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.