Permission Checking Flaw in Moodle Affects User Access Control
CVE-2025-3644

4.3MEDIUM

Key Information:

Vendor

Moodle
Status
Vendor
CVE Published:
25 April 2025

What is CVE-2025-3644?

A security flaw in the Moodle Learning Platform was identified, where insufficient checks allowed users to delete course sections beyond their permissions. This could potentially lead to unauthorized changes and data loss. It underscores the importance of robust access controls to prevent misuse by users who do not have the authority to modify course content.

References

https://access.redhat.com/security/cve/CVE-2025-3644
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2359745
issue-trackingx_refsource_REDHAT
https://moodle.org/mod/forum/discuss.php?d=467605

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank James E. Calder for reporting this issue.
.