The vulnerability is an authorization bypass in the block_configurable_reports_get_report_data web service, which, when permission checks fail, still returns a full report table. This flaw allows any authenticated user to supply arbitrary report identifiers and read SQL reports containing user and grade data that should otherwise be restricted. Because the response is delivered regardless of authorization, the impact is primarily a confidentiality breach of sensitive Moodle data.

Vulnerable systems are installations of the Moodle Configurable Reports block from the jleyva project with a version earlier than 5.3.0. End‑users of Moodle sites that have not applied this block upgrade are at risk.

The CVSS score of 7.1 classifies the flaw as high severity, and the lack of a KEV listing combined with an unknown EPSS score suggests moderate exploitation risk. While an attacker requires a valid authenticated session, the web service can be called with any report id, making the exploit trivial for compromised or malicious users. Consequently, any logged‑in user can gain unauthorized access to privileged report data, underscoring the need for prompt remediation.