Moodle has an IDOR in messaging web service which allows access to some user details

Description

References

• nvd.nist.gov/vuln/detail/CVE-2025-3645 · ADVISORY
• moodle/moodle commit 2fd810c · WEB
• moodle/moodle commit a817984 · WEB
• moodle/moodle commit bb65eff · WEB
• access.redhat.com/security/cve/CVE-2025-3645 · WEB
• bugzilla.redhat.com/show_bug.cgi · WEB
• moodle/moodle · PACKAGE
• github.com/search · WEB
• moodle.org/mod/forum/discuss.php · WEB

Autres vulnérabilités de moodle/moodle

• CVE-2026-26047MOYENNE 6.5A denial-of-service vulnerability was identified in Moodle’s TeX formula editor. When rendering TeX content using mimetex, insufficient exec…
• CVE-2026-26045ÉLEVÉE 7.2A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during proce…
• CVE-2025-67857MOYENNE 5.3A flaw was found in moodle. During anonymous assignment submissions, user identifiers were inadvertently exposed in URLs. This data exposure…
• CVE-2025-67856CRITIQUE 9.8A flaw was found in Moodle. An authorization logic flaw, specifically due to incomplete role checks during the badge awarding process, allow…
• CVE-2025-67855MOYENNE 6.1A flaw was found in mooodle. A remote attacker could exploit a reflected Cross-Site Scripting (XSS) vulnerability in the policy tool return …