CVE-2024-43433

What it actually does

The vulnerability allows suspended Moodle users to retain or incorrectly gain Matrix room membership and elevated power levels due to improper synchronization of user suspension status with Matrix room permissions.

Why it matters to the business

Suspended users may continue to access sensitive communication channels in integrated Matrix rooms, potentially leading to unauthorized data access or disruption in educational or organizational environments using Moodle.

How an attack unfolds

An attacker identifies a suspended Moodle user account that still has active Matrix integration. By attempting to interact with Matrix rooms, the attacker exploits the failure to revoke permissions, maintaining access despite suspension.

How to fix it

Upgrade moodle/moodle (GIT) to the fixed commit cc2edf3b8ccaa116e19ea2bb5daec7ed8adb3acd to ensure proper revocation of Matrix room membership and power levels for suspended users.

How to confirm the fix worked

Confirm the applied commit or version includes cc2edf3b8ccaa116e19ea2bb5daec7ed8adb3acd. Test by suspending a user and verifying immediate removal from all Matrix rooms with correct power level revocation.

Typical attack path

1. Identify suspended Moodle user with active Matrix integration
2. Retain or reuse Matrix session credentials without revocation
3. Access or modify rooms using incorrect power levels
4. Perform unauthorized actions while evading standard suspension controls

How to detect it

Examine Moodle logs and Matrix integration events for user suspension records that do not trigger corresponding room membership revocations or power level changes.

What your security team should do

• Apply the fixed commit to all Moodle instances with Matrix integration
• Audit existing Matrix rooms for any suspended users retaining membership
• Review integration configuration to ensure status sync is enabled
• Monitor user suspension events and corresponding Matrix permission changes