GHSA-cp8m-h777-g4p3MediumCVSS 5.3

Improper Access Control in moodle

Published
February 19, 2024
Last Modified
March 14, 2026

🔗 CVE IDs covered (1)

CVE-2024-25980 →

📋 Description

Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers.

🎯 Affected products3

  • composer/moodle/moodle:>= 4.3.0, < 4.3.3
  • composer/moodle/moodle:>= 4.2.0, < 4.2.6
  • composer/moodle/moodle:< 4.1.9

🔗 References (7)