CVE-2025-3640: Moodle: idor in web service allows users enrolled in a course to access some details of other users
A flaw was found in Moodle. Insufficient capability checks made it possible for a user enrolled in a course to access some details, such as the full name and profile image URL, of other users they did not have permission to access.
Other sources
Insufficient capability checks made it possible for a user enrolled in a course to access some details (full name and profile image URL) of other users they did not have permission to access.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3640?
CVE-2025-3640 is categorized as a medium-severity vulnerability due to insufficient capability checks in Moodle.
How do I fix CVE-2025-3640?
To fix CVE-2025-3640, update to the latest version of Moodle where the vulnerability has been patched.
What type of vulnerability is CVE-2025-3640?
CVE-2025-3640 is an authorization flaw that allows unauthorized access to user information.
Who is affected by CVE-2025-3640?
Users enrolled in Moodle courses may be affected if they are able to access information about other users without permission.
What information can be accessed due to CVE-2025-3640?
Due to CVE-2025-3640, users may gain unauthorized access to other users' full names and profile image URLs.