Moodle Incorrect Authorization vulnerability

HIGH 8.8CVE-2020-14321 · BIT-moodle-2020-14321 · GHSA-9q29-jcjw-fw7h · Published 16/08/2022 · updated 17/06/2026

In short

CVE-2020-14321 is a HIGH (CVSS 8.8) vulnerability affecting moodle/moodle, moodle (moodle).
Chance of exploitation in the next 30 days (EPSS): 16.2%, higher than 96.9% of all vulnerabilities.
Fix: update to 3.7.7, 3.8.4, 3.9.1, 3.5.13 or later.

Package	Affected versions	Patched versions
moodle/moodle Packagist	`≥ 3.6.0-beta, < 3.7.7≥ 3.8.0-beta, < 3.8.4≥ 3.9.0-beta, < 3.9.1< 3.5.13`	`3.7.73.8.43.9.13.5.13`
moodle moodle	`= 3.9.0≥ 3.5.0, < 3.5.13≥ 3.7.0, < 3.7.7≥ 3.8.0, < 3.8.4`	`3.5.133.7.73.8.4`

In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign themselves the manager role within that course.

NVD description

In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign themselves the manager role within that course.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

Packagist

≥ 3.6.0-beta, < 3.7.7≥ 3.8.0-beta, < 3.8.4≥ 3.9.0-beta, < 3.9.1< 3.5.13

3.7.73.8.43.9.13.5.13

= 3.9.0≥ 3.5.0, < 3.5.13≥ 3.7.0, < 3.7.7≥ 3.8.0, < 3.8.4

3.5.133.7.73.8.4

More vulnerabilities in moodle/moodle

See all →