CVE-2025-62400: Moodle: hidden group names visible to event creators
A missing capability check in the calendar event creation flow allows users with event creation rights to see names of hidden or separate groups. This may expose group names meant to remain private within a course.
Versions affected: 5.0 to 5.0.2, 4.5 to 4.5.6, 4.4 to 4.4.10, 4.1 to 4.1.20 and earlier unsupported versions Versions fixed: 5.0.3, 4.5.7, 4.4.11 and 4.1.21
Other sources
Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups. This could reveal private or restricted group information.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62400?
CVE-2025-62400 is considered a medium severity vulnerability.
How does CVE-2025-62400 affect users of Moodle?
CVE-2025-62400 allows users who can create calendar events to see the names of hidden groups, potentially exposing private information.
What versions of Moodle are impacted by CVE-2025-62400?
CVE-2025-62400 affects vulnerable versions of Moodle where the permissions related to group visibility are misconfigured.
How do I fix CVE-2025-62400 in Moodle?
To fix CVE-2025-62400, adjust user permissions to ensure that only authorized users can view hidden group information.
Is there a patch available for CVE-2025-62400?
Yes, updates and patches addressing CVE-2025-62400 are usually released by Moodle, and users should apply these updates as soon as they are available.