The vulnerability is a missing capability check in Moodle’s core_grades_get_gradeitems web service. Enrolled users can list hidden grade item identifiers, names, and categories through the mobile or AJAX interface. This grants unauthorized disclosure of gradebook data that is meant to remain confidential, potentially revealing student performance trends and grades that should be hidden from other students. The weakness is a classic missing authorization flaw (CWE‑862).

The flaw affects Moodle Project releases 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0. All editions that include the core_grades_get_gradeitems web service are at risk, regardless of custom modifications.

The CVSS score of 5.3 indicates a medium severity vulnerability. No EPSS score is available, but the vulnerability is not listed in CISA KEV, suggesting limited, documented exploitation. The likely attack vector is a legitimate client making a call to the exposed web service; an authenticated user with a course role can manipulate the request to retrieve hidden items. Because the flaw only allows information disclosure and not code execution or data manipulation, the overall risk is moderate but still requires timely remediation.