CVE-2025-67856

Published: Feb 3, 2026Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

A flaw was found in Moodle. An authorization logic flaw, specifically due to incomplete role checks during the badge awarding process, allowed badges to be granted without proper verification. This could enable unauthorized users to obtain badges they are not entitled to, potentially leading to privilege escalation or unauthorized access to certain features.

Affected (5)

Products: Moodle: Moodle

1 product

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Moodle Moodle	Before 4.1.22
Moodle Moodle	From 4.4.0 to 4.4.12
Moodle Moodle	From 4.5.0 to 4.5.8
Moodle Moodle	From 5.0.0 to 5.0.4
Moodle Moodle	Version 5.1.0

Related CWEs

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (2)

https://access.redhat.com/security/cve/CVE-2025-67856

Source: patrick@puiterwijk.org

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2423864

Source: patrick@puiterwijk.org

Third Party Advisory

Timeline

No history available yet.