CVE-2014-7831

Moodle exposes hidden grades to students

4.0 MediumFix available

lib/classes/grades_external.php in Moodle 2.7.x before 2.7.3 does not consider the moodle/grade:viewhidden capability before displaying hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role to access the get_grades web service.

Exploit likelihood

1.67%Up 0.5 points since Feb 4, 2022

What each source reports

NVD Score used 4.0

Record: CVE-2014-7831
CVSS 2.0: 4.0 MediumAV:N/AC:L/Au:S/C:P/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

CVE List No score

Record: CVE-2014-7831
Updated: 2026-11-02

EUVDEUVD-2022-2552 No score

Record: EUVD-2022-2552
Updated: 2026-11-03

GitHub AdvisoriesGHSA-59j6-8g7w-prf7 No score

Moodle exposes hidden grades to students

Record: GHSA-59j6-8g7w-prf7
Weakness: CWE-200
Updated: 2026-11-02

OSVGHSA-59j6-8g7w-prf7 No score

Moodle exposes hidden grades to students

Record: GHSA-59j6-8g7w-prf7
Weakness: CWE-200
Updated: 2026-11-02

Affected products

moodle

Affected packages

Affected packages
Package	Affected	Fixed
`moodle/moodle` Packagist	2.7.0 up to 2.7.3	2.7.3
`moodle/moodle` Packagist	2.7.0 up to 2.7.3, plus listed versions v2.7.0v2.7.1v2.7.2	2.7.3

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-7831 is a medium vulnerability (CVSS 4.0) in Moodle, published November 24, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.67%, the 76th percentile. Fixed in moodle/moodle 2.7.3.