CVE-2016-2159: The save_submission function in mod/assign/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2...

Security readout for executives and security teams

This Moodle flaw lets an authenticated student bypass assignment due-date restrictions through a web-service request. The core business impact is academic process integrity: late submissions may be accepted when the platform should reject them. Exposure is most likely in Moodle deployments running the affected version ranges, especially where assignment submission web services are enabled or reachable to student accounts. Public unauthenticated exposure is not indicated by the sources. Prioritize remediation for active Moodle learning environments before assessment periods. This is not evidenced as internet-scale exploitation, but it can undermine grading rules and institutional trust where students have accounts. Mitigation focus: Upgrade Moodle 2.7.x to 2.7.13 or later.; Upgrade Moodle 2.8.x to 2.8.11 or later.; Upgrade Moodle 2.9.x to 2.9.5 or later..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.