CVE-2025-67856: Moodle: moodle: privilege escalation via incomplete role checks in badge awarding
A flaw was found in Moodle. An authorization logic flaw, specifically due to incomplete role checks during the badge awarding process, allowed badges to be granted without proper verification. This could enable unauthorized users to obtain badges they are not entitled to, potentially leading to privilege escalation or unauthorized access to certain features.
Other sources
An authorization logic flaw allowed badges to be granted without full role verification. This stemmed from incomplete role checks in the badge awarding process.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-67856?
CVE-2025-67856 has been classified as a privilege escalation vulnerability.
How do I fix CVE-2025-67856?
To remediate CVE-2025-67856, upgrade Moodle to the latest versions 5.1.1, 5.0.4, 4.5.8, 4.4.12, or 4.1.22.
What impact does CVE-2025-67856 have on Moodle users?
CVE-2025-67856 allows unauthorized users to be awarded badges without the necessary role checks.
Which versions of Moodle are affected by CVE-2025-67856?
Versions of Moodle prior to 5.1.1, 5.0.4, 4.5.8, 4.4.12, and 4.1.22 are affected by CVE-2025-67856.
Who reported CVE-2025-67856?
CVE-2025-67856 was identified as an authorization logic flaw in the Moodle badge awarding process.