GitHub Advisoryadvisory · Packagist

GHSA-422v-w6c5-vq42 Moodle exposed the names of hidden groups to users

MEDIUM Published 2025-10-23 Modified 2025-10-24 Official page ↗
Aliases
CVE-2025-62400
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2025-10-24

Affected packages

• Packagist moodle/moodle: >= 5.0.0-beta, < 5.0.3 → fixed in 5.0.3 • Packagist moodle/moodle: >= 4.5.0-beta, < 4.5.7 → fixed in 4.5.7 • Packagist moodle/moodle: >= 4.2.0-beta, < 4.4.11 → fixed in 4.4.11 • Packagist moodle/moodle: < 4.1.21 → fixed in 4.1.21

Description

Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups. This could reveal private or restricted group information.

Related

Alias · CVE (1)

  • CVE-2025-62400 Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References