CVE-2026-7278: CSRF and missing capability check in Moodle MNet administration
The MNet page admin/mnet/peers.php changed a setting before Moodle checked administration permissions, and without a session token. The setting decides whether Moodle accepts connections from all hosts in the MNet network.
1Summary
- Advisory
- MSA-26-0011
- System
- Moodle
- Component
- MNet administration (admin/mnet)
- Class
- CSRF and missing authorisation
- Severity
- Minor
MNet links several Moodle sites together, for example to share a login. On the page listing connected hosts, administrators decide whether any host in the network may connect or only hosts added one by one.
The page read the switch for that right at the start, before admin_externalpage_setup() checked permissions. It did not ask for a sesskey either.
Reported by Vincent Schneider through the Moodle security process, published as MSA-26-0011.
2Who is affected
Users without administration permissions, and logged-in administrators who open a prepared page.
According to the advisory, both the token check and the capability check were insufficient. Accounts without administration permissions could flip the setting, and another website could do the same through a logged-in administrator's browser.
The switch only has an effect on sites that actually use MNet.
3Impact
The one thing that could be changed was whether Moodle accepts connections from all hosts in the network. On a site with MNet in use, that decides which outside installations may connect.
4Fix
- Affected versions
- 5.1.0 to 5.1.3, 5.0.0 to 5.0.6, 4.5.10 and earlier
- Fixed in
- 5.1.4, 5.0.7, 4.5.11
- Published
- 29 Apr 2026
- Fix in the source
- c4efb89
The page now handles the change only after admin_externalpage_setup() and only with a valid token, checked by confirm_sesskey(). The link on the page supplies the token.
We check for this class of flaw in every project we build or audit. For third-party code as a security audit.
5 / Contact
Should we review your Moodle plugins?
Describe your project in three short steps. We usually reply within one business day.