GHSA-34g7-pg9j-pxgp
Moodle allows IDOR when accessing the cohorts report
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | moodle/moodle | < 4.1.18 | 4.1.18 |
| Packagist | moodle/moodle | >= 4.3.0-beta, < 4.3.12 | 4.3.12 |
| Packagist | moodle/moodle | >= 4.4.0-beta, < 4.4.8 | 4.4.8 |
| Packagist | moodle/moodle | >= 4.5.0-beta, < 4.5.4 | 4.5.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
A flaw was discovered in Moodle. Additional checks were required to ensure that users can only access cohort data they are authorized to retrieve.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2025-3647
- https://github.com/moodle/moodle/commit/bd6ec0ac84cf0f73ab35e7e244e1f9b06929083a
- https://access.redhat.com/security/cve/CVE-2025-3647
- https://bugzilla.redhat.com/show_bug.cgi?id=2359762
- https://github.com/moodle/moodle
- https://moodle.org/mod/forum/discuss.php?d=467607