CVE-2024-25980

What it actually does

The H5P attempts report in Separate Groups mode fails to enforce group membership checks, exposing user data from other groups to non-editing teachers who should not see it.

Why it matters to the business

Organizations using Moodle face unintended exposure of learner activity data across course groups, increasing privacy compliance risks and eroding trust in group-based access controls.

How an attack unfolds

An authenticated user with the non-editing teacher role navigates to the H5P attempts report for a course configured with Separate Groups; the missing authorization check returns records belonging to other groups, allowing the attacker to view learner names and attempt details they are not permitted to see.

How to fix it

Upgrade Moodle to a version containing commit 8a38a37f1ff5075c6f46d726c1457172c2fccac3 or later; verify that group restrictions are enforced in the H5P attempts report after deployment.

How to confirm the fix worked

After patching, create test courses with Separate Groups, assign non-editing teachers to distinct groups, populate H5P activities, and confirm the attempts report displays only same-group users.

Typical attack path

1. Obtain non-editing teacher role in a Moodle course with Separate Groups enabled
2. Locate and open the H5P attempts report interface
3. Observe that the report includes entries for users outside the attacker's assigned group
4. Export or record the unauthorized learner data

How to detect it

Search Moodle access and report logs for non-editing teacher accounts querying H5P attempts reports in courses configured with Separate Groups; look for repeated or broad data exports that cross expected group boundaries.

What your security team should do

• Apply the fix from commit 8a38a37f1ff5075c6f46d726c1457172c2fccac3 immediately on all Moodle instances
• Audit non-editing teacher permissions in courses using Separate Groups
• Review H5P activity reports for any prior unauthorized data access
• Monitor for future Moodle security releases and establish a rapid patching process