CVE-2025-32045: Moodle Reveals Hidden Grades to Unauthorized Users
Summary
CVE-2025-32045: Moodle shows hidden grades to users without permission on some grade reports. Affects moodle/moodle across 4 version ranges.
< 4.1.17
>= 4.3.0-beta, < 4.3.11
>= 4.4.0-beta, < 4.4.7
>= 4.5.0-beta, < 4.5.3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Moodle is a widely used open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It offers various features such as course management, grading, and reporting tools. However, a recent vulnerability has been identified that compromises the integrity of its grading system, allowing unauthorized users to access hidden grades.
Vulnerability Detail
A flaw in Moodle's grade reporting system has been discovered, where insufficient capability checks permit users without the necessary permissions to view hidden grades. This vulnerability arises from the lack of proper authorization checks in certain grade reports, potentially leading to unauthorized access to sensitive grading information. The ramifications of this issue can include breaches of student privacy and the integrity of the grading system, which could undermine trust in the platform.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.174.1.17composer require moodle/moodle:4.1.17 -
>= 4.3.0-beta, < 4.3.114.3.11composer require moodle/moodle:4.3.11 -
>= 4.4.0-beta, < 4.4.74.4.7composer require moodle/moodle:4.4.7 -
>= 4.5.0-beta, < 4.5.34.5.3composer require moodle/moodle:4.5.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, administrators can restrict access to grade reports until the update is applied. This can be done by modifying user roles and permissions to ensure that only authorized users can view grade reports.
Conclusion
In summary, CVE-2025-32045 is a significant vulnerability in Moodle that allows unauthorized access to hidden grades. It is crucial for users to update their installations to the patched versions to mitigate this risk. Administrators should also consider implementing temporary workarounds to protect sensitive information until the update is applied.
See every vulnerability recorded for moodle/moodle →
FAQ
CVE-2025-32045 is a vulnerability in Moodle that allows unauthorized users to view hidden grades due to insufficient capability checks in grade reports.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability could lead to unauthorized access to sensitive grading information, compromising student privacy and the integrity of the grading system.
You can update Moodle by running the command 'composer update moodle/moodle' to ensure you are using a patched version.
The CVSS score of this vulnerability is 5.3, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
