~ / search / GHSA-qhc7-xhc2-7p7w

GHSA-qhc7-xhc2-7p7w

Moodle self enrollment available before completing second factor with MFA enabled

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-3634

Packages

EcosystemPackageAffectedFixed in
Packagist moodle/moodle >= 4.3.0-beta, < 4.3.12 4.3.12
Packagist moodle/moodle >= 4.4.0-beta, < 4.4.8 4.4.8
Packagist moodle/moodle >= 4.5.0-beta, < 4.5.4 4.5.4

Details

As written in the advisory (Markdown source, shown as plain text).

A security vulnerability was discovered in Moodle that allows students to enroll themselves in courses without completing all the necessary safety checks. Specifically, users can sign up for courses prematurely, even if they haven't finished two-step verification processes.

References

External links from the advisory. They lead to third-party sites.