CVE-2025-62400
Medium · 4.3CVSS
4.3
EPSS
0.3%
Published
Oct 23, 2025
CISA due date
—
The record
Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups. This could reveal private or restricted group information.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | moodle/moodle | 0 | 4.1.21 |
| Packagist | moodle/moodle | 4.2.0-beta | 4.4.11 |
| Packagist | moodle/moodle | 4.5.0-beta | 4.5.7 |
| Packagist | moodle/moodle | 5.0.0-beta | 5.0.3 |
| Bitnami | moodle | 4.1.0 | 4.1.21 |
| packagist | moodle/moodle | 4.2.0-beta | 4.4.11 |
| packagist | moodle/moodle | 4.5.0-beta | 4.5.7 |
| packagist | moodle/moodle | 5.0.0-beta | 5.0.3 |
Related vulnerabilities
- GHSA-422v-w6c5-vq42 Moodle exposed the names of hidden groups to users Same vulnerability
- GHSA-ggxq-2mg9-8966 Moodle has a Remote Code Execution risk via file restore Also affects moodle/moodle
- GHSA-cg8j-5cr2-568q Moodle TeX formula editor is vulnerable to DoS through lack of execution time limits Also affects moodle/moodle
- CVE-2026-26047 A denial-of-service vulnerability was identified in Moodle’s TeX formula editor. Also affects moodle/moodle
- CVE-2026-26045 A flaw was identified in Moodle’s backup restore functionality where specially crafted… Also affects moodle/moodle
- GHSA-5cx4-w4fh-fr57 Moodle Affected by Improper Restriction of Excessive Authentication Attempts Also affects moodle/moodle
- GHSA-8jrv-wx83-w3xj Moodle Inserts Sensitive Information Into Sent Data Also affects moodle/moodle
- GHSA-hcm6-q6pc-xfhm Moodle has an authorization logic flaw Also affects moodle/moodle