CVE-2025-67857
Medium · 4.3CVSS
4.3
EPSS
0.4%
Published
Feb 3, 2026
CISA due date
—
The record
A flaw was found in moodle. During anonymous assignment submissions, user identifiers were inadvertently exposed in URLs. This data exposure allows unauthorized viewers to see internal user IDs, compromising the intended anonymity and potentially leading to information disclosure.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | moodle/moodle | 0 | 4.1.22 |
| Packagist | moodle/moodle | 4.4.0-beta | 4.4.12 |
| Packagist | moodle/moodle | 4.5.0-beta | 4.5.8 |
| Packagist | moodle/moodle | 5.0.0-beta | 5.0.4 |
| Packagist | moodle/moodle | 5.1.0-beta | 5.1.1 |
Related vulnerabilities
- GHSA-8jrv-wx83-w3xj Moodle Inserts Sensitive Information Into Sent Data Same vulnerability
- GHSA-ggxq-2mg9-8966 Moodle has a Remote Code Execution risk via file restore Also affects moodle/moodle
- GHSA-cg8j-5cr2-568q Moodle TeX formula editor is vulnerable to DoS through lack of execution time limits Also affects moodle/moodle
- CVE-2026-26047 A denial-of-service vulnerability was identified in Moodle’s TeX formula editor. Also affects moodle/moodle
- CVE-2026-26045 A flaw was identified in Moodle’s backup restore functionality where specially crafted… Also affects moodle/moodle
- GHSA-5cx4-w4fh-fr57 Moodle Affected by Improper Restriction of Excessive Authentication Attempts Also affects moodle/moodle
- GHSA-hcm6-q6pc-xfhm Moodle has an authorization logic flaw Also affects moodle/moodle
- GHSA-qv78-6gpp-hm68 Moodle Open Redirect vulnerability Also affects moodle/moodle