BIT-moodle-2025-67857

vendorUSosv

Moodle: moodle: data exposure of user identifiers in urls

view advisory published 2026-02-12Licence: per source

A flaw was found in moodle. During anonymous assignment submissions, user identifiers were inadvertently exposed in URLs. This data exposure allows unauthorized viewers to see internal user IDs, compromising the intended anonymity and potentially leading to information disclosure.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-67857US	medium5.3	0.36% (30th)	—	2026-02-03
A flaw was found in moodle. During anonymous assignment submissions, user identifiers were inadvertently exposed in URLs. This data exposure allows unauthorized viewers to see inte…

references

External citations — patches, advisories, analysis.

https://access.redhat.com/security/cve/CVE-2025-67857ADVISORY
https://bugzilla.redhat.com/show_bug.cgi?id=2423868ADVISORY
https://moodle.org/mod/forum/discuss.php?d=471307ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2025-67857WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan