MSA-25-0058: Participants can access forum ratings without permission

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2025-12-15 12:22 UTC
Importiert: 2026-06-20 16:03 UTC
Quelle-ID: moodle
uid_hash: 1210d192fbee36c659b9df92ec72a27b3fa0bfef156277ceeea3600b3192db7b

Moodle Security Announcements

by Michael Hawkins.

Forum ratings required additional permission checks to prevent users from being able to view ratings they did not have the capability to access.

Severity/Risk: Minor

Versions affected: 5.1, 5.0 to 5.0.3, 4.5 to 4.5.7, 4.4 to 4.4.11, 4.1 to 4.1.21 and earlier unsupported versions

Versions fixed: 5.1.1, 5.0.4, 4.5.8, 4.4.12 and 4.1.22

Reported by: Stefan Hanauska

CVE identifier: CVE-2025-67854

Tracker issue: MDL-86960 Participants can access forum ratings without permission

CVE-ID	Severity (Quelle)	CVSS (Quelle)	Severity (CVE.org)	CVSS (CVE.org)	EPSS	EPSS-Pctl	Veroeffentlicht (CVE.org)
CVE-2025-67854

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
Moodle Security Announcements	moodle	vendor_advisory	cms	-	de	https://moodle.org/rss/file.php/154821/7ef1adaa0762dfdd7cd390868b6d9f2b/mod_forum/996/rss.xml