BIT-moodle-2025-3640

vendorUSosv

Moodle: idor in web service allows users enrolled in a course to access some details of other users

view advisory published 2026-01-26Licence: per source

A flaw was found in Moodle. Insufficient capability checks made it possible for a user enrolled in a course to access some details, such as the full name and profile image URL, of other users they did not have permission to access.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-3640US	—	0.39% (33rd)	—	2025-04-25
A flaw was found in Moodle. Insufficient capability checks made it possible for a user enrolled in a course to access some details, such as the full name and profile image URL, of…

references

External citations — patches, advisories, analysis.

https://access.redhat.com/security/cve/CVE-2025-3640ADVISORY
https://bugzilla.redhat.com/show_bug.cgi?id=2359734REPORT
https://moodle.org/mod/forum/discuss.php?d=467601ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2025-3640WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan