CVE-2025-3640 Moodle: idor in web service allows users enrolled in a course to access some details of other users

🗓️ 25 Apr 2025 14:43:02Reported by fedoraType

IDOR flaw in Moodle allows unauthorized user data access within enrolled courses.

Reporter	Title	Published	Views	Family All 26
BDU FSTEC	The vulnerability in the virtual learning environment Moodle, related to bypassing authentication using a user-controlled key, allows intruders to elevate their privileges and gain unauthorized access to protected information.	30 Apr 202500:00	–	bdu_fstec
Circl	CVE-2025-3640	25 Apr 202517:19	–	circl
CNNVD	Moodle 安全漏洞	22 Apr 202500:00	–	cnnvd
CNVD	Moodle Information Disclosure Vulnerability	7 May 202500:00	–	cnvd
CVE	CVE-2025-3640	25 Apr 202514:43	–	cve
EUVD	EUVD-2025-12522	3 Oct 202520:07	–	euvd
Github Security Blog	Moodle has an IDOR in web service which allows users enrolled in a course to access some details of other users	25 Apr 202515:31	–	github
NVD	CVE-2025-3640	25 Apr 202515:15	–	nvd
OpenVAS	Moodle Multiple Vulnerabilities (MSA-25-0013, MSA-25-0018, MSA-25-0019, MSA-25-0020, MSA-25-0021, MSA-25-0022, MSA-25-0023, MSA-25-0024, MSA-25-0025, MSA-25-0026, MSA-25-0027, MSA-25-0028)	24 Apr 202500:00	–	openvas
OSV	BIT-MOODLE-2025-3640 Moodle: idor in web service allows users enrolled in a course to access some details of other users	26 Jan 202614:49	–	osv

[
  {
    "versions": [
      {
        "status": "affected",
        "version": "4.5.0",
        "lessThan": "4.5.4",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "4.4.0",
        "lessThan": "4.4.8",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "4.3.0",
        "lessThan": "4.3.12",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "4.1.0",
        "lessThan": "4.1.18",
        "versionType": "semver"
      }
    ],
    "packageName": "moodle",
    "collectionURL": "https://git.moodle.org",
    "defaultStatus": "unaffected"
  }
]

Source	Link
access	www.access.redhat.com/security/cve/CVE-2025-3640
moodle	www.moodle.org/mod/forum/discuss.php
bugzilla	www.bugzilla.redhat.com/show_bug.cgi

28 Apr 2025 16:47Current

CVSS 3.14.3

EPSS0.00163

CWE-639