GHSA-hcm6-q6pc-xfhm
Moodle has an authorization logic flaw
At a glance
- Published
- Updated
- CVE
- CVE-2025-67856
- Aliases
- BIT-moodle-2025-67856
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Description
A flaw was found in Moodle. An authorization logic flaw, specifically due to incomplete role checks during the badge awarding process, allowed badges to be granted without proper verification. This could enable unauthorized users to obtain badges they are not entitled to, potentially leading to privilege escalation or unauthorized access to certain features.
Affected packages
| Package | Versions |
|---|---|
| Packagist · moodle/moodle | introduced 0, fixed 4.1.22 |
| Packagist · moodle/moodle | introduced 4.4.0-beta, fixed 4.4.12 |
| Packagist · moodle/moodle | introduced 4.5.0-beta, fixed 4.5.8 |
| Packagist · moodle/moodle | introduced 5.0.0-beta, fixed 5.0.4 |
| Packagist · moodle/moodle | introduced 5.1.0-beta, fixed 5.1.1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-67856 ADVISORY
- https://github.com/moodle/moodle/commit/0d48779e61bcacbabbcb82858a037b567351fce0 WEB
- https://access.redhat.com/security/cve/CVE-2025-67856 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2423864 WEB
- https://github.com/moodle/moodle PACKAGE
- https://moodle.org/mod/forum/discuss.php?d=471306 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |