GHSA-422v-w6c5-vq42
Moodle exposed the names of hidden groups to users
At a glance
- Published
- Updated
- CVE
- CVE-2025-62400
- Aliases
- BIT-moodle-2025-62400
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Description
Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups. This could reveal private or restricted group information.
Affected packages
| Package | Versions |
|---|---|
| Packagist · moodle/moodle | introduced 5.0.0-beta, fixed 5.0.3 |
| Packagist · moodle/moodle | introduced 4.5.0-beta, fixed 4.5.7 |
| Packagist · moodle/moodle | introduced 4.2.0-beta, fixed 4.4.11 |
| Packagist · moodle/moodle | introduced 0, fixed 4.1.21 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-62400 ADVISORY
- https://github.com/moodle/moodle/commit/0c70d67059658879a71152ea075c74154a627d05 WEB
- https://access.redhat.com/security/cve/CVE-2025-62400 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2404433 WEB
- https://github.com/moodle/moodle PACKAGE
- https://moodle.org/mod/forum/discuss.php?d=470389 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |