PT-2026-6433 · Packagist · Moodle/Moodle

Published 2026-02-03 · Updated 2026-02-03

OSV

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

A flaw was found in Moodle. An authorization logic flaw, specifically due to incomplete role checks during the badge awarding process, allowed badges to be granted without proper verification. This could enable unauthorized users to obtain badges they are not entitled to, potentially leading to privilege escalation or unauthorized access to certain features.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

GHSA-HCM6-Q6PC-XFHM

Affected Products

Moodle/Moodle

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-67856 · Security Note
• https://osv.dev/vulnerability/GHSA-hcm6-q6pc-xfhm · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/0d48779e61bcacbabbcb82858a037b567351fce0 · Note
• https://moodle.org/mod/forum/discuss.php?d=471306 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2423864 · Note
• https://access.redhat.com/security/cve/CVE-2025-67856 · Note