MSA-25-0060: Badges with a role criterion could be awarded to users who do not hold the role

Kurzinfo

Metadaten

  • Original (extern): Link oeffnen
  • Veroeffentlicht: 2025-12-15 12:23 UTC
  • Importiert: 2026-06-22 12:20 UTC
  • CVSS: 5.4
  • Quelle-ID: moodle
  • uid_hash: 7a2557efb09c32aa834839cc35896e8f16a82c790812547663fa729fd06f14cd
Moodle Security Announcements

Inhalt

by Michael Hawkins.

Badges being awarded with a role performed the correct capability check, but did not verify the user had the required role to meet the award criterion.

Severity/Risk: Minor

Versions affected: 5.1, 5.0 to 5.0.3, 4.5 to 4.5.7, 4.4 to 4.4.11, 4.1 to 4.1.21 and earlier unsupported versions

Versions fixed: 5.1.1, 5.0.4, 4.5.8, 4.4.12 and 4.1.22

Reported by: Stefan Hanauska

CVE identifier: CVE-2025-67856

Changes (main): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-86507

Tracker issue: MDL-86507 Badges with a role criterion could be awarded to users who do not hold the role

Verknuepfte CVEs

CVE-ID Severity (Quelle) CVSS (Quelle) Severity (CVE.org) CVSS (CVE.org) EPSS EPSS-Pctl Veroeffentlicht (CVE.org)

CVE-2025-67856

MEDIUM

5.4

MEDIUM

5.4

2026-02-03

Quellen-Details

Bezeichnung Name Kategorie Tags Zielgruppe Sprache Feed-URL
Moodle Security Announcements

moodle

 vendor_advisory cms - de https://moodle.org/rss/file.php/154821/7ef1adaa0762dfdd7cd390868b6d9f2b/mod_forum/996/rss.xml
Zurueck zur Eintrags-Liste