PT-2026-5964 · Moodle+1 · Moodle+1

Published 2026-02-03 · Updated 2026-02-24 · CVE-2025-67856

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Moodle (affected versions not specified)

Description A flaw exists in Moodle related to authorization logic. Incomplete role checks during the badge awarding process can allow badges to be granted without proper verification. This could enable unauthorized users to obtain badges they are not entitled to, potentially leading to privilege escalation or unauthorized access to features.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-MOODLE-2025-67856

CVE-2025-67856

GHSA-HCM6-Q6PC-XFHM

Affected Products

Moodle

Red Os

References · 16

• https://cve.org/CVERecord?id=CVE-2025-67856 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-67856 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67856 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-67856 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-67856 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-moodle-2025-67856 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hcm6-q6pc-xfhm · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/0d48779e61bcacbabbcb82858a037b567351fce0 · Note
• https://moodle.org/mod/forum/discuss.php?d=471306 · Note
• https://twitter.com/VulmonFeeds/status/2018658338905461022 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-moodle-cve-2025-67856-7.3 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2423864 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-moodle-cve-2025-67856-8.0 · Note
• https://twitter.com/CVEnew/status/2018646515233763660 · Twitter Post