CVE-2025-62394: Moodle: quiz notifications sent to suspended participants
Due to insufficient enrolment validation, quiz notifications could be sent to users with inactive or suspended enrolments. This information disclosure occurs automatically through the notification system and can reveal limited details about ongoing assessments.
Versions affected: 5.0 to 5.0.2 and 4.5 to 4.5.6 Versions fixed: 5.0.3 and 4.5.7
Other sources
Moodle failed to verify enrolment status correctly when sending quiz notifications. As a result, suspended or inactive users might receive quiz-related messages, leaking limited course information.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62394?
CVE-2025-62394 is considered a medium severity vulnerability due to potential information leakage.
How do I fix CVE-2025-62394?
To fix CVE-2025-62394, update your Moodle installation to the latest patched version provided by the vendor.
Who is affected by CVE-2025-62394?
CVE-2025-62394 affects Moodle installations that improperly verify enrolment status of users.
What type of vulnerability is CVE-2025-62394?
CVE-2025-62394 is an information disclosure vulnerability related to quiz notifications in Moodle.
What could happen if CVE-2025-62394 is exploited?
If CVE-2025-62394 is exploited, suspended or inactive users might receive quiz notifications that reveal limited course information.