CVE-2025-32044: Moodle User Data Exposure via Unauthenticated REST API
Summary
CVE-2025-32044: Moodle allows unauthenticated REST API user data exposure. Affects moodle/moodle versions >= 4.5.0-beta, < 4.5.3. Fixed in 4.5.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is a widely-used open-source learning management system (LMS) designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It offers features such as course management, user enrollment, and assessment tools. However, certain configurations of Moodle can expose sensitive user data through its REST API, particularly when specific PHP settings are not properly configured.
Vulnerability Detail
A vulnerability exists in Moodle that allows unauthenticated users to access sensitive user data, including names, contact information, and hashed passwords, through stack traces returned by certain API calls. This issue arises when the PHP setting 'zend.exception_ignore_args' is disabled, making the system susceptible to information disclosure. The ramifications of this vulnerability can lead to unauthorized access to personal information, potentially compromising user privacy and security.
How To Fix
Minimum fixed version
4.5.3
This is the first release that contains the fix.
composer require moodle/moodle:4.5.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can enable the 'zend.exception_ignore_args' setting in your php.ini file by adding or modifying the following line: 'zend.exception_ignore_args = 1'. This will prevent sensitive information from being exposed in stack traces.
Conclusion
The vulnerability CVE-2025-32044 poses a significant risk to Moodle installations that do not have the appropriate PHP settings configured. It is essential to update to the patched version and consider the recommended workarounds to protect sensitive user data from unauthorized access.
See every vulnerability recorded for moodle/moodle →
FAQ
CVE-2025-32044 is a vulnerability in Moodle that allows unauthenticated users to access sensitive user data through unauthenticated REST API calls.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can expose sensitive user data, including names, contact information, and hashed passwords.
If an immediate update is not possible, enable the 'zend.exception_ignore_args' setting in your php.ini file as a temporary workaround.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
