CVE-2025-3636: Moodle IDOR Vulnerability in RSS Block Allows Unauthorized Access
Summary
CVE-2025-3636: Moodle allows IDOR in RSS block, which allows access to additional RSS feeds. Affects moodle/moodle across 4 version ranges.
< 4.1.18
>= 4.3.0-beta, < 4.3.12
>= 4.4.0-beta, < 4.4.8
>= 4.5.0-beta, < 4.5.4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2025-3636 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is a widely-used open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It supports various functionalities, including course management, user management, and content delivery. However, Moodle has a vulnerability that allows unauthorized users to access additional RSS feeds due to insufficient capability checks in the RSS block.
Vulnerability Detail
The vulnerability identified as CVE-2025-3636 is an Insecure Direct Object Reference (IDOR) issue found in the RSS block of Moodle. This flaw allows unauthorized users to access and view RSS feeds that they should not have permission to see. The root cause of this vulnerability lies in the lack of proper capability checks, which can lead to potential data exposure and privacy concerns. Attackers could exploit this vulnerability to gather sensitive information from RSS feeds, impacting the overall security of the Moodle platform.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.184.1.18composer require moodle/moodle:4.1.18 -
>= 4.3.0-beta, < 4.3.124.3.12composer require moodle/moodle:4.3.12 -
>= 4.4.0-beta, < 4.4.84.4.8composer require moodle/moodle:4.4.8 -
>= 4.5.0-beta, < 4.5.44.5.4composer require moodle/moodle:4.5.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can restrict access to the RSS block by modifying user permissions until the software is updated. This can be done by navigating to the user roles and capabilities settings in Moodle and ensuring that only authorized users have access to the RSS feeds.
Conclusion
CVE-2025-3636 is a significant vulnerability in Moodle that allows unauthorized access to RSS feeds. It is crucial for users to update their installations to the patched versions to mitigate this risk. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for moodle/moodle →
FAQ
CVE-2025-3636 is a vulnerability in Moodle that allows unauthorized access to RSS feeds due to insufficient capability checks.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The vulnerability affects Moodle versions prior to 4.1.18, 4.3.12, 4.4.8, and 4.5.4.
As a temporary measure, restrict access to the RSS block by modifying user permissions to limit exposure until an update can be applied.
The CVSS score for this vulnerability is 4.3, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
