The vulnerability occurs when the plugin fails to verify that the supplied element identifier belongs to the authorized course context during certificate element edits, allowing a teacher with the mod/customcert:manage capability in any single course to view and silently overwrite certificate elements belonging to other courses. This results in unauthorized disclosure and data tampering, classically classified as improper authorization (CWE-639).

Affected systems are Moodle installations that use the mdjnelson/moodle-mod_customcert plugin with versions earlier than 4.4.9 for the 4.x line and earlier than 5.0.3 for the 5.x line. All courses managed by users holding the mod/customcert:manage capability are potential targets.

The CVSS score is 9.6, indicating a critical severity. EPSS data is not available, and the vulnerability is not included in the CISA KEV catalog. Exploitation requires only teacher-level access with the mod/customcert:manage capability; no additional conditions or privileges are needed. An attacker can trigger the flaw by sending requests to the core_get_fragment callback editelement or to the mod_customcert_save_element web service, benefiting from the missing ownership check on elementid.