CVE-2016-8644: In Moodle 2.x and 3.x, the capability to view course notes is checked in the wrong context.

Security readout for executives and security teams

This Moodle issue is an authorization mistake: the system checked permission to view course notes in the wrong place. That could let some users see notes they should not see, depending on role configuration and note usage. Public sources do not provide severity scoring or confirmed exploitation. Organizations running Moodle 2.x or 3.x may be exposed, especially where course notes are used and roles have nuanced course, category, or site-level permissions. Prioritize if Moodle stores student, staff, or sensitive course notes. The business risk is unauthorized information disclosure, but urgency is hard to score because public severity and exploitation evidence are incomplete. Mitigation focus: Review Moodle advisory guidance for fixed versions and required updates.; Move affected Moodle instances to a supported, vendor-fixed release where possible.; Audit roles with course note viewing permissions across site, category, and course contexts..

Prepared

Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.