CVE-2025-26526: Moodle Feedback Response Permissions Bypass Vulnerability
Summary
CVE-2025-26526: Feedback response viewing and deletions did not respect Separate Groups mode. Affects moodle across 4 version ranges.
>= 4.1.0, < 4.1.16
>= 4.3.0, < 4.3.10
>= 4.4.0, < 4.4.6
>= 4.5.0, < 4.5.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle/moodle · Packagist
The same CVE-2025-26526 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It supports various functionalities such as course management, user enrollment, and feedback activities. However, a vulnerability has been identified that affects the permissions related to viewing and deleting feedback responses, particularly in Separate Groups mode.
Vulnerability Detail
The vulnerability arises from the failure to enforce Separate Groups mode restrictions during permission checks for viewing and deleting responses in Feedback activities. This oversight allows unauthorized users to access or delete feedback responses, potentially compromising the integrity of the feedback system and violating user privacy. The issue is present in multiple versions of Moodle, specifically from versions 4.1.0 to 4.5.0, with fixed versions available.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.1.0, < 4.1.164.1.16 -
>= 4.3.0, < 4.3.104.3.10 -
>= 4.4.0, < 4.4.64.4.6 -
>= 4.5.0, < 4.5.24.5.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider disabling the Separate Groups mode in your feedback activities until the update can be applied. This can be done through the Moodle admin settings under the feedback activity configuration.
Conclusion
The CVE-2025-26526 vulnerability in Moodle poses a significant risk to user privacy and data integrity due to improper permission checks in feedback activities. It is crucial for users to update their installations to the patched versions to mitigate this risk.
See every vulnerability recorded for moodle →
FAQ
CVE-2025-26526 is a vulnerability in Moodle that allows unauthorized viewing and deletion of feedback responses due to improper permission checks.
The vulnerability affects Moodle versions 4.1.0 to 4.5.0.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
If exploited, this vulnerability can lead to unauthorized access to sensitive feedback data, compromising user privacy and data integrity.
Regularly update your Moodle installation to the latest patched versions and monitor for vulnerabilities using tools like Vulert.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle.
