CVE-2025-26527: Moodle Non-Searchable Tags Exposure Vulnerability
Summary
CVE-2025-26527: Moodle's non-searchable tags can still be discovered on the tag search page and in the tags block. Affects moodle/moodle across 4 version ranges.
< 4.1.16
>= 4.3.0-beta, < 4.3.10
>= 4.4.0-beta, < 4.4.6
>= 4.5.0-beta, < 4.5.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2025-26527 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Moodle is a widely-used open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It offers features such as course management, user management, and various plugins to enhance functionality. However, a vulnerability has been identified that allows non-searchable tags to be discovered by users, potentially exposing sensitive information.
Vulnerability Detail
The vulnerability arises from the improper handling of non-searchable tags within Moodle. Users who should not have access to certain tags can still discover them through the tag search page or the tags block. This exposure can lead to unauthorized access to content or information that should remain hidden, thereby compromising user privacy and the integrity of the learning environment.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.164.1.16composer require moodle/moodle:4.1.16 -
>= 4.3.0-beta, < 4.3.104.3.10composer require moodle/moodle:4.3.10 -
>= 4.4.0-beta, < 4.4.64.4.6composer require moodle/moodle:4.4.6 -
>= 4.5.0-beta, < 4.5.24.5.2composer require moodle/moodle:4.5.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can restrict user access to the tag search page and tags block until the package is updated. This can be done by modifying user permissions in the Moodle settings to limit visibility of tags.
Conclusion
The CVE-2025-26527 vulnerability in Moodle exposes non-searchable tags to unauthorized users, which can lead to privacy breaches. It is crucial for users to update their Moodle installations to the latest patched versions to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for moodle/moodle →
FAQ
The vulnerability allows users to discover non-searchable tags that should not be visible to them, potentially exposing sensitive information.
If you are using Moodle versions prior to 4.5.2, 4.4.6, 4.3.10, or 4.1.16, your installation is likely affected by this vulnerability.
The exposure of non-searchable tags can lead to unauthorized access to sensitive content, compromising user privacy and the integrity of the learning environment.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software by analyzing the composer.lock file.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
