CVE-2024-45690

What it actually does

Missing authorization checks in the OAuth2 account linking workflow allow authenticated users to delete linked accounts belonging to other users rather than only their own.

Why it matters to the business

Attackers with low-privileged accounts can remove other users' linked authentication methods, causing account lockouts, loss of access, and increased support burden for affected organizations running Moodle.

How an attack unfolds

An attacker authenticates to a Moodle instance, identifies the OAuth2 linkage endpoint, crafts requests that omit or manipulate user identifiers, and triggers deletion of arbitrary linked accounts without server-side ownership verification.

How to fix it

Upgrade Moodle to the commit d4f5e92ee156002b95db1ab6f76e25870563e2f6 or later; apply the corresponding Ubuntu libarchive updates if those packages are present in the environment.

How to confirm the fix worked

After patching, attempt account deletion as a non-owner user and verify that the operation is rejected with an authorization error; review release notes for the listed commit to confirm the added ownership checks are present.

Typical attack path

1. Obtain a low-privileged Moodle account
2. Locate OAuth2 linkage management URLs
3. Submit deletion requests with altered user or linkage identifiers
4. Confirm successful removal of target accounts via repeated login attempts or API responses

How to detect it

Search Moodle web server and application logs for repeated or anomalous calls to OAuth2 linkage deletion endpoints, especially requests containing mismatched user identifiers or originating from non-admin accounts.

What your security team should do

• Apply the fixed Moodle commit immediately given the 7.5 CVSS rating
• Audit recent OAuth2 linkage deletion events in logs for anomalies
• Restrict OAuth2 provider configuration to least-privilege scopes until patches are deployed