CVE-2024-48897

What it actually does

Missing authorization checks allow authenticated users to edit or delete RSS feeds belonging to other users or courses without the required permissions.

Why it matters to the business

Attackers with low-level access can tamper with or remove RSS content used for announcements and feeds, disrupting information flow and requiring manual recovery.

How an attack unfolds

An attacker obtains a low-privileged Moodle account, identifies RSS feed management endpoints, and submits direct edit or delete requests that bypass permission verification because additional checks were not enforced.

How to fix it

Apply the latest Moodle security update that adds the required permission checks for RSS feed modification. Verify the patch is installed across all instances.

How to confirm the fix worked

After patching, test that non-owners and users without the managefeeds capability can no longer edit or delete RSS feeds via the web interface and direct API calls.

Typical attack path

1. Obtain a valid low-privileged user account on the Moodle instance
2. Locate RSS feed management URLs via application navigation or API discovery
3. Craft and send HTTP requests to edit or delete feeds without ownership or role checks
4. Confirm success by observing that feeds outside the attacker's scope are modified or removed

How to detect it

Search web server and application logs for unexpected edit or delete actions on RSS feeds performed by users without the managefeeds capability; review audit logs for feed modifications that lack corresponding permission grants.

What your security team should do

• Prioritize patching all Moodle instances within the next maintenance window
• Review RSS feed permissions and ownership in the database for any existing unauthorized changes
• Enable detailed logging of RSS feed modifications for ongoing monitoring