CVE-2025-3640: Moodle IDOR Vulnerability Allows Unauthorized User Data Access
Summary
CVE-2025-3640: A flaw was found in Moodle. Affects moodle/moodle across 4 version ranges.
< 4.1.18
>= 4.3.0-beta, < 4.3.12
>= 4.4.0-beta, < 4.4.8
>= 4.5.0-beta, < 4.5.4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is a widely used open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It offers a range of features including course management, user management, and various plugins to enhance functionality. However, a recent vulnerability has been identified that affects user data privacy within the platform.
Vulnerability Detail
A flaw was found in Moodle due to insufficient capability checks in its web service. This vulnerability allows users enrolled in a course to access sensitive details of other users, such as their full names and profile image URLs, without having the necessary permissions. This could lead to unauthorized access to personal information, potentially compromising user privacy and security.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.184.1.18composer require moodle/moodle:4.1.18 -
>= 4.3.0-beta, < 4.3.124.3.12composer require moodle/moodle:4.3.12 -
>= 4.4.0-beta, < 4.4.84.4.8composer require moodle/moodle:4.4.8 -
>= 4.5.0-beta, < 4.5.44.5.4composer require moodle/moodle:4.5.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can limit user access to sensitive information by adjusting user roles and permissions within the Moodle settings. This can help mitigate the risk until the platform is updated.
Conclusion
The IDOR vulnerability in Moodle (CVE-2025-3640) poses a risk to user privacy by allowing unauthorized access to personal information. It is crucial for users and administrators to update their Moodle installations to the latest patched versions to mitigate this risk.
See every vulnerability recorded for moodle/moodle →
FAQ
CVE-2025-3640 is a vulnerability in Moodle that allows users enrolled in a course to access details of other users they should not have access to, due to insufficient capability checks.
This vulnerability can lead to unauthorized access to personal information of users, such as their full names and profile images, which can compromise user privacy.
Affected versions include all versions prior to 4.1.18, 4.3.12, 4.4.8, and 4.5.4.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
