CVE-2025-67856
Medium · 5.4CVSS
5.4
EPSS
0.3%
Published
Feb 3, 2026
CISA due date
—
The record
A flaw was found in Moodle. An authorization logic flaw, specifically due to incomplete role checks during the badge awarding process, allowed badges to be granted without proper verification. This could enable unauthorized users to obtain badges they are not entitled to, potentially leading to privilege escalation or unauthorized access to certain features.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | moodle/moodle | 0 | 4.1.22 |
| Packagist | moodle/moodle | 4.4.0-beta | 4.4.12 |
| Packagist | moodle/moodle | 4.5.0-beta | 4.5.8 |
| Packagist | moodle/moodle | 5.0.0-beta | 5.0.4 |
| Packagist | moodle/moodle | 5.1.0-beta | 5.1.1 |
Related vulnerabilities
- GHSA-hcm6-q6pc-xfhm Moodle has an authorization logic flaw Same vulnerability
- GHSA-ggxq-2mg9-8966 Moodle has a Remote Code Execution risk via file restore Also affects moodle/moodle
- GHSA-cg8j-5cr2-568q Moodle TeX formula editor is vulnerable to DoS through lack of execution time limits Also affects moodle/moodle
- CVE-2026-26047 A denial-of-service vulnerability was identified in Moodle’s TeX formula editor. Also affects moodle/moodle
- CVE-2026-26045 A flaw was identified in Moodle’s backup restore functionality where specially crafted… Also affects moodle/moodle
- GHSA-5cx4-w4fh-fr57 Moodle Affected by Improper Restriction of Excessive Authentication Attempts Also affects moodle/moodle
- GHSA-8jrv-wx83-w3xj Moodle Inserts Sensitive Information Into Sent Data Also affects moodle/moodle
- GHSA-qv78-6gpp-hm68 Moodle Open Redirect vulnerability Also affects moodle/moodle