CVE-2025-26526: Feedback response viewing and deletions did not respect Separate Groups mode
Separate Groups mode restrictions were not factored into permission checks before allowing viewing or deletion of responses in Feedback activities.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.1.16 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.3.10 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.4.6 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.5.2
Event History
Frequently Asked Questions
What is the severity of CVE-2025-26526?
The severity of CVE-2025-26526 is considered medium due to improper permission checks in the feedback module.
How do I fix CVE-2025-26526?
To fix CVE-2025-26526, upgrade to Moodle version 4.1.16 or later, or 4.3.10, 4.4.6, or 4.5.2 as specified in the vulnerability report.
What impact does CVE-2025-26526 have on my Moodle installation?
CVE-2025-26526 allows unauthorized users to view or delete feedback responses, potentially leading to data leaks.
Which versions of Moodle are affected by CVE-2025-26526?
Affected versions of Moodle include versions prior to 4.1.16, 4.3.10, 4.4.6, and 4.5.2.
Is it necessary to update Moodle to mitigate CVE-2025-26526?
Yes, updating Moodle to the fixed versions is essential to mitigate the risks associated with CVE-2025-26526.