CVE-2025-49518

Overview

Moodle is an open source learning management system written in PHP. Schools, universities, and companies use it to run online courses. IOMAD is a multi-tenant distribution of Moodle that lets one installation serve several companies or organizations; it is built on Moodle core and shares the affected code. The core_course_get_recent_courses web service returns the courses a user has accessed most recently. It is available to Moodle's own pages through AJAX and to the official Moodle mobile app.

An Insecure Direct Object Reference (IDOR) vulnerability (CVE-2025-49518) has been identified in this web service in Moodle and IOMAD, which allows a user who holds the ordinary profile-viewing capability over another user to fetch that user's recently accessed courses by passing their user ID. Moodle tracks this issue as MSA-25-0036 (MDL-79993).

Per MITRE CWE-639: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

This issue affects all versions of Moodle before 4.1.19, versions 4.2.0 through 4.4.8, versions 4.5.0 through 4.5.4, and version 5.0.0, including End-of-Life release lines such as Moodle 4.3. IOMAD releases built on these Moodle versions contain the same code and are affected as well.

Details

Module Info

• Product: Moodle, IOMAD
• Affected packages: moodle/moodle (course/externallib.php)
• Affected versions: <4.1.19, >=4.2.0 <4.4.9, >=4.5.0 <4.5.5, >=5.0.0 <5.0.1
• GitHub repository: https://github.com/moodle/moodle (Moodle), https://github.com/iomad/iomad (IOMAD)
• Published packages: https://packagist.org/packages/moodle/moodle
• Package manager: Composer
• Fixed in:
  • OSS Moodle 4.1.19, 4.4.9, 4.5.5, 5.0.1
  • NES for Moodle v4.3.13
  • NES for IOMAD v4.3.4

Vulnerability Info

This Low-severity vulnerability is found in the moodle/moodle package in all versions before 4.1.19, 4.2.0 through 4.4.8, 4.5.0 through 4.5.4, and 5.0.0 of Moodle, and in IOMAD releases built on those versions. Moodle rates it Minor.

core_course_external::get_recent_courses() takes an optional userid parameter and defaults to the caller. When the ID belongs to someone else, it decided whether to answer with this check:

        $usercontext = context_user::instance($userid);

        self::validate_context($usercontext);

        if ($userid != $USER->id and !has_capability('moodle/user:viewdetails', $usercontext)) {
            return array();
        }

        $courses = course_get_recent_courses($userid, $limit, $offset, $sort);

moodle/user:viewdetails is the general capability for viewing user profiles. Here it is checked in the target user's context, so it is satisfied by any role that grants it in that context or above it, such as a parent or mentor role assigned over the user, or a role assigned at site level. Being allowed to view someone's profile does not imply being allowed to see what they do on the site, yet it was enough to list the courses that user had recently opened, with each course's summary data.

The response reveals which courses another user has been using and how recently, which can disclose their enrolments and activity. It does not expose grades or course content. With Moodle's default role definitions, a student asking about a classmate does not hold the capability in the classmate's user context and gets an empty list.

The fix requires moodle/user:viewalldetails instead, which by default only the manager archetype has:

        if ($userid != $USER->id && !has_capability('moodle/user:viewalldetails', $usercontext)) {
            return array();
        }

Mitigation

Moodle publishes security fixes only for its supported release lines. Earlier release lines, including Moodle 4.3 and the IOMAD releases built on it, are End-of-Life and will not receive any public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to Moodle 4.1.19, 4.4.9, 4.5.5, 5.0.1, or later, or to an IOMAD release built on one of those versions.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• B3XAL (finder)