Moodle IDOR when deleting OAuth2 linked accounts

HIGH 7.5CVE-2024-45690 · BIT-moodle-2024-45690 · GHSA-fhg2-r2h9-h7q8 · Published 20/11/2024 · updated 17/06/2026

In short

CVE-2024-45690 is a HIGH (CVSS 7.5) vulnerability affecting moodle/moodle, moodle (moodle).
Chance of exploitation in the next 30 days (EPSS): 0.36%, higher than 30.1% of all vulnerabilities.
Fix: update to 4.2.10, 4.3.7, 4.4.3, 4.1.13 or later.

Package	Affected versions	Patched versions
moodle/moodle Packagist	`≥ 4.2.0-beta, < 4.2.10≥ 4.3.0-beta, < 4.3.7≥ 4.4.0-beta, < 4.4.3< 4.1.13`	`4.2.104.3.74.4.34.1.13`
moodle moodle	`≥ 4.2.0, < 4.2.10≥ 4.3.0, < 4.3.7≥ 4.4.0, < 4.4.3< 4.1.13`	`4.2.104.3.74.4.34.1.13`

A flaw was found in Moodle. Additional checks were required to ensure users can only delete their OAuth2-linked accounts.

NVD description

A flaw was found in Moodle. Additional checks were required to ensure users can only delete their OAuth2-linked accounts.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

Packagist

≥ 4.2.0-beta, < 4.2.10≥ 4.3.0-beta, < 4.3.7≥ 4.4.0-beta, < 4.4.3< 4.1.13

4.2.104.3.74.4.34.1.13

≥ 4.2.0, < 4.2.10≥ 4.3.0, < 4.3.7≥ 4.4.0, < 4.4.3< 4.1.13

4.2.104.3.74.4.34.1.13

More vulnerabilities in moodle/moodle

See all →