CVE-2025-62400: Moodle exposed the names of hidden groups to users
A missing capability check in the calendar event creation flow allows users with event creation rights to see names of hidden or separate groups. This may expose group names meant to remain private within a course.
Versions affected: 5.0 to 5.0.2, 4.5 to 4.5.6, 4.4 to 4.4.10, 4.1 to 4.1.20 and earlier unsupported versions Versions fixed: 5.0.3, 4.5.7, 4.4.11 and 4.1.21
Other sources
Moodle exposed the names of hidden groups to users
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.1.21 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.4.11 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.5.7 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 5.0.3 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 5.0.3 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 4.5.7 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 4.4.11 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 4.1.21
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62400?
CVE-2025-62400 is considered a medium severity vulnerability.
How does CVE-2025-62400 affect users of Moodle?
CVE-2025-62400 allows users who can create calendar events to see the names of hidden groups, potentially exposing private information.
What versions of Moodle are impacted by CVE-2025-62400?
CVE-2025-62400 affects vulnerable versions of Moodle where the permissions related to group visibility are misconfigured.
How do I fix CVE-2025-62400 in Moodle?
To fix CVE-2025-62400, adjust user permissions to ensure that only authorized users can view hidden group information.
Is there a patch available for CVE-2025-62400?
Yes, updates and patches addressing CVE-2025-62400 are usually released by Moodle, and users should apply these updates as soon as they are available.