GitHub Advisoryadvisory · Packagist
GHSA-rjcm-7v2p-9265 Moodle course access permissions are not properly checked in course_output_fragment_course_overview
MEDIUM
Official page ↗
- Aliases
- CVE-2025-62393
- Ecosystem
- Packagist
- Packages
- moodle/moodle
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-284
- Reviewed
- 2025-10-24
Affected packages
• Packagist moodle/moodle: >= 5.0.0-beta, < 5.0.3 → fixed in 5.0.3
Description
A flaw was found in the course overview output function where user access permissions were not fully enforced. This could allow unauthorized users to view information about courses they should not have access to, potentially exposing limited course details.
Related
Alias · CVE (1)
- CVE-2025-62393 A flaw was found in the course overview output function where user access permissions were not fully enforced. vulnerability
Weakness · CWE (1)
- CWE-284 Improper Access Control weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-62393 advisory
- https://github.com/moodle/moodle/commit/fc69b4744ba0132cc3093fd81940be15bc293835 web
- https://access.redhat.com/security/cve/CVE-2025-62393 web
- https://bugzilla.redhat.com/show_bug.cgi?id=2404426 web
- https://github.com/moodle/moodle package
- https://moodle.org/mod/forum/discuss.php?d=470381 web