CVE-2025-26526: Moodle Feedback Response Viewing and Deletion Vulnerability
Summary
CVE-2025-26526: Moodle's feedback response viewing and deletions did not respect Separate Groups mode. Affects moodle/moodle across 4 version ranges.
< 4.1.16
>= 4.3.0-beta, < 4.3.10
>= 4.4.0-beta, < 4.4.6
>= 4.5.0-beta, < 4.5.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2025-26526 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It supports various activities, including quizzes, forums, and feedback mechanisms. The platform's feedback module allows users to collect responses from participants, but it has a vulnerability that compromises the integrity of response viewing and deletion in Separate Groups mode.
Vulnerability Detail
The vulnerability arises from the failure to enforce Separate Groups mode restrictions during permission checks for viewing and deleting feedback responses. This oversight allows users to access and manipulate responses that should be restricted to their specific group, potentially leading to unauthorized data exposure and manipulation. The issue is rooted in the permission handling logic within the feedback activity module, which does not adequately segregate user access based on group membership.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.164.1.16composer require moodle/moodle:4.1.16 -
>= 4.3.0-beta, < 4.3.104.3.10composer require moodle/moodle:4.3.10 -
>= 4.4.0-beta, < 4.4.64.4.6composer require moodle/moodle:4.4.6 -
>= 4.5.0-beta, < 4.5.24.5.2composer require moodle/moodle:4.5.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can manually review and restrict access to feedback responses by adjusting user permissions and group settings until the package is updated to a secure version.
Conclusion
CVE-2025-26526 represents a significant vulnerability in Moodle's feedback module, allowing unauthorized access to feedback responses due to inadequate permission checks. It is crucial for administrators to update their Moodle installations to the latest patched versions to safeguard against potential data breaches.
See every vulnerability recorded for moodle/moodle →
FAQ
CVE-2025-26526 is a vulnerability in Moodle that allows unauthorized viewing and deletion of feedback responses due to improper permission checks in Separate Groups mode.
If your Moodle installation is affected, users may gain access to feedback responses from other groups, leading to potential data breaches and privacy issues.
The affected versions include Moodle 4.5.0-beta to 4.5.1, 4.4.0-beta to 4.4.5, 4.3.0-beta to 4.3.9, and all versions up to 4.1.15.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 6.5, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
