CVE-2016-5012: In Moodle 3.x, glossary search displays entries without checking user permissions to view them.

Security readout for executives and security teams

Moodle 3.x glossary search could show glossary entries without enforcing the viewer's permissions. The business risk is unintended disclosure of course or internal content, especially on sites with restricted learner groups, private glossary entries, or external users. Exposure is most relevant to Moodle 3.x deployments using the Glossary activity with entries that depend on visibility, role, group, or course permissions. Treat as a targeted confidentiality risk, not a confirmed emergency. Prioritize quickly for internet-facing or externally shared Moodle sites that store sensitive course, staff, customer, or student information. Mitigation focus: Check Moodle's advisory or forum guidance for the fixed release or recommended workaround.; Upgrade affected Moodle 3.x installations according to vendor guidance.; Review glossary activities for sensitive or restricted entries..

Prepared

Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.