Moodle 5.2
Moodle 5.2
Third-party support for the Moodle 5.2: 24/7 engineers manage issues, remediate vulnerabilities, and help you maintain compliance — independent of the vendor contract.
24/7 engineers own your Moodle 5.2 incidents end to end.
Mitigation and patch-around guidance when the vendor no longer ships fixes.
Controls evidence and documentation that keep auditors satisfied.
Specifications
- product
- moodle
- release
- 5.2
- product Label
- Moodle
- release Label
- 5.2
- codename
- lts
- latest Version
- 5.2.4
- release Date
- 2026-04-20
- maintained
- true
- source Url
- https://endoflife.date/moodle
Lifecycle Dates
- End of Service Life
- Oct 4, 2027
- Last OEM Support
- Apr 19, 2027
OEM vs. 3rd Party Support
See how third-party support compares to the vendor contract for Moodle 5.2 — monitoring, break/fix, vulnerability work, operations and compliance, before and after EOSL.
| Feature | OEM Support | 3rd Party Support |
|---|---|---|
| Post-EOSL Support | ||
| Break/Fix Support | Until EOSL | |
| 24/7 Monitoring | ||
| Vulnerability Scanning & Remediation | ||
| Managed Operations | ||
| Procedure & Configuration Review | ||
| Compliance & Audit Documentation | Limited | |
| Discounted Migration to Other Platforms |
Why Choose 3rd Party Support for Moodle 5.2?
Vulnerability Remediation
Scanning, mitigation and patch-around guidance for Moodle 5.2 when the vendor no longer ships fixes.
Compliance Maintenance
Procedure review, controls evidence and the documentation auditors ask for — maintained continuously, not scrambled at audit time.
24/7 Expert Support
Engineers who know this release monitor, manage and fix issues around the clock — break/fix to managed operations.
Moodle 5.2 Support: Frequently Asked Questions
Is the Moodle 5.2 still supported?
Yes. The Moodle 5.2 is currently supported by Moodle, and third-party support is available as an alternative — issue management, vulnerability remediation, and compliance help independent of the vendor contract.
When is the Moodle 5.2 end of service life (EOSL) date?
Moodle lists the end of service life for the Moodle 5.2 as Oct 4, 2027.
Can I keep using the Moodle 5.2 after its EOSL date?
Yes. EOSL means Moodle stops issuing patches and support — the software itself keeps running. Third-party support covers it from there: issue management, security vulnerability remediation, and the compliance documentation auditors ask for, for as long as you choose to run it.
How much does third-party support for the Moodle 5.2 cost?
Typically 40-70% below the OEM maintenance renewal price. Exact pricing depends on quantity, service level and location. You get an indicative price within 24 hours and a firm quote within 48.
Known Vulnerabilities Affecting Moodle 5.2
12 published CVEs affect the Moodle 5.2. Our 24/7 engineers help you assess exposure, prioritize fixes and apply available patches.
| CVE | Severity | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-102588 | MEDIUM | 6.5 | Sep 30, 2026 | A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthorized requests on the victim's behalf. This flaw allows a remote attacker to set or overwrite student grades without authorization. |
| CVE-2026-102578 | MEDIUM | 5.5 | Sep 30, 2026 | A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL (Structured Query Language) injection vulnerability. This issue could allow an attacker to view, alter, or delete sensitive data stored in the underlying database. |
| CVE-2026-102581 | MEDIUM | 4.6 | Sep 30, 2026 | A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting (XSS) vulnerability. An attacker can inject malicious content into a forum post, which then executes arbitrary script code in the browser of another user viewing the affected post. |
| CVE-2026-102586 | MEDIUM | 4.3 | Sep 30, 2026 | A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting (XSS) attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary script in the victim's browser. |
| CVE-2026-102585 | MEDIUM | 4.3 | Sep 30, 2026 | A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses they do not have authorization to access. |
| CVE-2026-102584 | MEDIUM | 4.3 | Sep 30, 2026 | A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores. |
| CVE-2026-102579 | MEDIUM | 4.3 | Sep 30, 2026 | A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course that they should not have permission to view. This issue leads to unauthorized information disclosure. |
| CVE-2026-102577 | MEDIUM | 4.3 | Sep 30, 2026 | A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted destinations, leading to Server-Side Request Forgery (SSRF). |
| CVE-2026-102587 | LOW | 2.7 | Sep 30, 2026 | A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure by inferring hidden user data. |
| CVE-2026-102583 | LOW | 2.7 | Sep 30, 2026 | A flaw was found in Moodle. An incorrect capability check in the artificial intelligence (AI) editor placement's image generation web service allows an authenticated user to invoke the feature without holding the required capability. This flaw permits unauthorized users to access and utilize the AI image generation functionality. |
| CVE-2026-102582 | LOW | 2.2 | Sep 30, 2026 | A flaw was found in Moodle. The manual enrolment management page did not properly check whether the manual enrolment plugin was disabled, allowing users with enrolment permissions to access the page directly by navigating to its URL. Consequently, an authorized user could manage manual enrolments even after an administrator disabled the feature in the user interface. |
| CVE-2026-102580 | LOW | 2.2 | Sep 30, 2026 | A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected application behavior. |