← volver
CVE-2025-67856

Moodle: moodle: privilege escalation via incomplete role checks in badge awarding

CVSS 5.4 MEDIUMEPSS 0.3%CWE-863
Vexday Risk Score
13Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 5.4EPSS 0.3%KEV nãoPoC Nuclei Metasploit Patch
Ciclo de vida
03 feb 2026Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
A flaw was found in Moodle. An authorization logic flaw, specifically due to incomplete role checks during the badge awarding process, allowed badges to be granted without proper verification. This could enable unauthorized users to obtain badges they are not entitled to, potentially leading to privilege escalation or unauthorized access to certain features.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Productos afectados
moodle

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →