GHSA-422v-w6c5-vq42
Moodle exposed the names of hidden groups to users
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | moodle/moodle | >= 5.0.0-beta, < 5.0.3 | 5.0.3 |
| Packagist | moodle/moodle | >= 4.5.0-beta, < 4.5.7 | 4.5.7 |
| Packagist | moodle/moodle | >= 4.2.0-beta, < 4.4.11 | 4.4.11 |
| Packagist | moodle/moodle | < 4.1.21 | 4.1.21 |
Details
As written in the advisory (Markdown source, shown as plain text).
Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups. This could reveal private or restricted group information.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2025-62400
- https://github.com/moodle/moodle/commit/0c70d67059658879a71152ea075c74154a627d05
- https://access.redhat.com/security/cve/CVE-2025-62400
- https://bugzilla.redhat.com/show_bug.cgi?id=2404433
- https://github.com/moodle/moodle
- https://moodle.org/mod/forum/discuss.php?d=470389