CVE-2025-3640
Moodle: idor in web service allows users enrolled in a course to access some details of other users
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Moodle: idor in web service allows users enrolled in a course to access some details of other users
A flaw was found in Moodle. Insufficient capability checks made it possible for a user enrolled in a course to access some details, such as the full name and profile image URL, of other users they did not have permission to access.
Reserved 2025-04-15 | Published 2025-04-25 | Updated 2025-04-28 | Assigner fedoraAuthorization Bypass Through User-Controlled Key
| 2025-04-15: | Reported to Red Hat. |
| 2025-04-22: | Made public. |
Red Hat would like to thank Khikhi for reporting this issue.
access.redhat.com/security/cve/CVE-2025-3640
bugzilla.redhat.com/show_bug.cgi?id=2359734 (RHBZ#2359734)
moodle.org/mod/forum/discuss.php?d=467601
Support options
