CVE-2025-67857 PUBLISHED

Moodle: moodle: data exposure of user identifiers in urls

Assigner: fedora
Reserved: 12.12.2025 Published: 03.02.2026 Updated: 03.02.2026

A flaw was found in moodle. During anonymous assignment submissions, user identifiers were inadvertently exposed in URLs. This data exposure allows unauthorized viewers to see internal user IDs, compromising the intended anonymity and potentially leading to information disclosure.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS Score: 4.3

Product Status

Package Collection https://github.com/moodle/moodle/
Package Name moodle
Versions Default: unaffected
  • affected from 4.1.0 to 4.1.22 (excl.)
  • affected from 4.4.0 to 4.4.12 (excl.)
  • affected from 4.5.0 to 4.5.8 (excl.)
  • affected from 5.0.0 to 5.0.4 (excl.)
  • affected from 5.1.0 to 5.1.1 (excl.)

Credits

  • Red Hat would like to thank Mihail Geshoski for reporting this issue.

References

Problem Types

  • Insertion of Sensitive Information Into Sent Data CWE