CVE-2025-3627: Moodle User Data Exposure Before MFA Completion
Summary
CVE-2025-3627: Moodle makes some user data available before completing second factor with MFA enabled. Affects moodle/moodle across 3 version ranges.
>= 4.3.0-beta, < 4.3.12
>= 4.4.0-beta, < 4.4.8
>= 4.5.0-beta, < 4.5.4
Fixed in 4.3.12, 4.4.8 or 4.5.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It supports various functionalities, including course management, user enrollment, and assessment tools. However, a vulnerability has been identified that compromises user data security when Multi-Factor Authentication (MFA) is enabled.
Vulnerability Detail
A security vulnerability in Moodle allows certain users to access sensitive information about other students before they complete the verification process of their identities using two-factor authentication (2FA). This issue arises from improper access controls that fail to restrict data visibility during the MFA process, potentially exposing personal and academic information to unauthorized users.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.3.0-beta, < 4.3.124.3.12composer require moodle/moodle:4.3.12 -
>= 4.4.0-beta, < 4.4.84.4.8composer require moodle/moodle:4.4.8 -
>= 4.5.0-beta, < 4.5.44.5.4composer require moodle/moodle:4.5.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can disable MFA for users until the package is updated. However, this is not recommended as it may expose the system to other security risks.
Conclusion
In summary, the CVE-2025-3627 vulnerability in Moodle poses a significant risk by allowing unauthorized access to user data during the MFA process. It is crucial for users to update to the latest patched versions to mitigate this risk and ensure the security of their systems.
See every vulnerability recorded for moodle/moodle →
FAQ
The vulnerability allows unauthorized access to sensitive user data before completing the MFA process.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could lead to unauthorized access to personal and academic information of users, compromising their privacy and security.
Yes, the CVSS score for this vulnerability is 4.3, indicating a moderate severity level.
If an immediate update is not possible, consider disabling MFA temporarily as a workaround, but be aware of the associated risks.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
