PT-2026-5958 · Moodle+1 · Moodle+1

Published 2026-02-03 · Updated 2026-02-24 · CVE-2025-67848

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Moodle (affected versions not specified)

Description A flaw exists in Moodle that allows suspended users to authenticate through the Learning Tools Interoperability (LTI) Provider. The issue stems from LTI authentication handlers not enforcing user suspension status, resulting in unauthorized access. This could lead to information disclosure or other unauthorized actions. The vulnerable component is the LTI authentication handler. The affected API endpoint is the LTI Provider authentication endpoint.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-280

Related Identifiers

BIT-MOODLE-2025-67848

CVE-2025-67848

GHSA-J5JV-W5CW-J9FF

Affected Products

Moodle

Red Os

References · 17

• https://moodle.org/mod/forum/discuss.php?d=471298 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67848 · Security Note
• https://ubuntu.com/security/CVE-2025-67848 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-67848 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j5jv-w5cw-j9ff · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-67848 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-moodle-2025-67848 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-67848 · Security Note
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/c2705e2c18962fec4f21b9c34ed386be2a379663 · Note
• https://github.com/moodle/moodle/commit/62f372e9d861d16df702d3c7726905fa2730e3d8 · Note
• https://t.me/cveNotify/150709 · Telegram Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2423831 · Note
• https://twitter.com/TheHackerWire/status/2018646270936813641 · Twitter Post
• https://twitter.com/CVEnew/status/2018646521701392747 · Twitter Post