The flaw allows an authenticated user to inject an arbitrary class name into the Report Builder's audience field. Because the system does not validate the provided class, it will instantiate that class, creating internal program objects on the server. This unexpected object creation can lead to application logic bypass or unintended side effects, possibly enabling further exploitation such as unauthorized operations.

Any Moodle deployment that includes the Report Builder component is affected. The vulnerability does not list specific versions, so all Moodle releases using the default Report Builder implementation are potentially vulnerable. Administrators should review the versions in use and verify if the flaw has been addressed in newer releases.

The CVSS score of 2.2 indicates a low severity impact if the flaw is successfully leveraged. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. The attack requires authenticated access; an attacker with a legitimate user account can submit a crafted request to the report builder endpoint in the web interface. While the potential for application compromise exists, the low CVSS suggests limited impact unless combined with other weaknesses. Administrators should monitor user activity and consider disabling or restricting the Report Builder for non‑trusted accounts.