CVE-2025-67857CWE-201

Moodle: moodle: data exposure of user identifiers in urls

Medium · published February 3, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
28.9
In the wild
Unconfirmed
What it is

A flaw was found in moodle. During anonymous assignment submissions, user identifiers were inadvertently exposed in URLs. This data exposure allows unauthorized viewers to see internal user IDs, compromising the intended anonymity and potentially leading to information disclosure.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00363 · 28.9th percentile
Weakness
CWE-201 · Insertion of Sensitive Information Into Sent Data
Published
2026-02-03T10:52Z
EPSS history
Timeline
  • 03 FEB 10:52Z
    Moodle: moodle: data exposure of user identifiers in urls
    cvelistv5