CVE-2025-3640CWE-639

Moodle: idor in web service allows users enrolled in a course to access some details of other users

Medium · published April 25, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
31.1
In the wild
Unconfirmed
What it is

A flaw was found in Moodle. Insufficient capability checks made it possible for a user enrolled in a course to access some details, such as the full name and profile image URL, of other users they did not have permission to access.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00383 · 31.1th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2025-04-25T14:43Z
EPSS history
Timeline
  • 25 APR 14:43Z
    Moodle: idor in web service allows users enrolled in a course to access some details of other users
    cvelistv5