Moodle has an IDOR in web service which allows users enrolled in a course to access some details of other users

🗓️ 25 Apr 2025 15:31:23Reported by GitHub Advisory DatabaseType

Moodle has an IDOR flaw allowing unauthorized access to other users' details in web service.

Reporter	Title	Published	Views	Family All 26
BDU FSTEC	The vulnerability in the virtual learning environment Moodle, related to bypassing authentication using a user-controlled key, allows intruders to elevate their privileges and gain unauthorized access to protected information.	30 Apr 202500:00	–	bdu_fstec
Circl	CVE-2025-3640	25 Apr 202517:19	–	circl
CNNVD	Moodle 安全漏洞	22 Apr 202500:00	–	cnnvd
CNVD	Moodle Information Disclosure Vulnerability	7 May 202500:00	–	cnvd
CVE	CVE-2025-3640	25 Apr 202514:43	–	cve
Cvelist	CVE-2025-3640 Moodle: idor in web service allows users enrolled in a course to access some details of other users	25 Apr 202514:43	–	cvelist
EUVD	EUVD-2025-12522	3 Oct 202520:07	–	euvd
NVD	CVE-2025-3640	25 Apr 202515:15	–	nvd
OpenVAS	Moodle Multiple Vulnerabilities (MSA-25-0013, MSA-25-0018, MSA-25-0019, MSA-25-0020, MSA-25-0021, MSA-25-0022, MSA-25-0023, MSA-25-0024, MSA-25-0025, MSA-25-0026, MSA-25-0027, MSA-25-0028)	24 Apr 202500:00	–	openvas
OSV	BIT-MOODLE-2025-3640 Moodle: idor in web service allows users enrolled in a course to access some details of other users	26 Jan 202614:49	–	osv

Vulners

Node

moodle moodleRange4.5.0-beta–4.5.4composer

moodle moodleRange4.4.0-beta–4.4.8composer

moodle moodleRange4.3.0-beta–4.3.12composer

moodle moodleRange<4.1.18composer

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-3640
access	www.access.redhat.com/security/cve/CVE-2025-3640
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
moodle	www.moodle.org/mod/forum/discuss.php
github	www.github.com/moodle/moodle/commit/64a4311266cbe9a9a942c836931bef224018b77d
github	www.github.com/advisories/GHSA-6g5x-h5x7-q4mq

25 Apr 2025 17:27Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.14.3

EPSS0.00163

SSVC