The vulnerability exposes sensitive student and teacher data through the core_grades_get_feedback web service. Because the service does not enforce group‑membership or enrollment checks, a teacher who does not have editing rights can supply arbitrary user identifiers and retrieve grade feedback for any student in other groups. The data exposed includes feedback text, as well as identity fields such as names and email addresses, thereby compromising confidentiality of personal information. No impact on integrity or availability is described.

Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 are affected. The issue is present in all versions listed within the Moodle Project’s Moodle application.

The CVSS score of 5.3 indicates a moderate severity vulnerability. The EPSS score is not available, so exploitation probability is unknown but cannot be ruled out. The vulnerability is not listed in the CISA KEV catalogue, suggesting no widespread exploitation has been publicly documented. Because the flaw requires only authenticated access as a teacher, the attack vector is remote via the web service. An attacker can simply call the web service endpoint and iterate over user IDs to harvest personal data, making the risk significant for institutions that rely on strict privacy controls.