CVE-2025-62395

Overview

Moodle is an open source learning management system written in PHP. Schools, universities, and companies use it to run online courses. IOMAD is a multi-tenant distribution of Moodle that lets one installation serve several companies or organizations; it is built on Moodle core and shares the affected code. Cohorts are site-wide or category-wide groups of users, often used to enrol a whole class or department into courses at once. Cohorts can be defined in the system context or in a course category, and the moodle/cohort:view and moodle/cohort:manage capabilities control who can see them.

An Improper Access Control vulnerability (CVE-2025-62395) has been identified in the core_cohort_search_cohorts web service of Moodle and IOMAD, which allows a user who can view or manage cohorts in a lower context, such as a course or category, to retrieve data about cohorts defined in the system context. Moodle tracks this issue as MSA-25-0044 (MDL-85421).

Per MITRE CWE-284: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

This issue affects all versions of Moodle before 4.1.21, versions 4.2.0 through 4.4.10, versions 4.5.0 through 4.5.6, and versions 5.0.0 through 5.0.2, including End-of-Life release lines such as Moodle 4.3. IOMAD releases built on these Moodle versions contain the same code and are affected as well.

Details

Module Info

• Product: Moodle, IOMAD
• Affected packages: moodle/moodle (cohort/externallib.php)
• Affected versions: <4.1.21, >=4.2.0 <4.4.11, >=4.5.0 <4.5.7, >=5.0.0 <5.0.3
• GitHub repository: https://github.com/moodle/moodle (Moodle), https://github.com/iomad/iomad (IOMAD)
• Published packages: https://packagist.org/packages/moodle/moodle
• Package manager: Composer
• Fixed in:
  • OSS Moodle 4.1.21, 4.4.11, 4.5.7, 5.0.3
  • NES for Moodle v4.3.13
  • NES for IOMAD v4.3.4

Vulnerability Info

This Medium-severity vulnerability is found in the moodle/moodle package in all versions before 4.1.21, 4.2.0 through 4.4.10, 4.5.0 through 4.5.6, and 5.0.0 through 5.0.2 of Moodle, and in IOMAD releases built on those versions. Moodle rates it Minor.

core_cohort_external::search_cohorts() takes a context and an includes parameter of self, parents, or all. It checked the caller's capability only in the context the caller supplied:

$manager = has_capability('moodle/cohort:manage', $context);
if (!$manager) {
    require_capability('moodle/cohort:view', $context);
}

With includes set to all, it then returned cohorts from anywhere on the site:

} else if ($includes == 'all') {
    $results = cohort_get_all_cohorts($limitfrom, $limitnum, $query);
    $results = $results['cohorts'];

cohort_get_all_cohorts() is not meant to be called without a system-level check. Its own documentation says so:

* The function assumes that user capability to view/manage cohorts on system level
* has already been verified. This function only checks if such capabilities have been
* revoked in child (categories) contexts.

By default, moodle/cohort:view is granted to the Teacher role at course level. A teacher, or a category manager, can therefore call the web service with their own course or category context and includes set to all, and receive the name, ID number, description, visibility, theme, and custom field data of system-level cohorts they could not otherwise see. The service is available through AJAX as well as web service tokens. Users who already hold moodle/cohort:view or moodle/cohort:manage in the system context gain nothing new.

The fix requires one of those capabilities in the system context before returning all cohorts, unless the request is already made in the system context:

} else if ($includes == 'all') {
    $contextsystem = context_system::instance();
    if (!$context instanceof context_system &&
            !has_any_capability(['moodle/cohort:view', 'moodle/cohort:manage'], $contextsystem)) {

        throw new required_capability_exception($contextsystem, 'moodle/cohort:view', 'nopermissions', '');
    }

Mitigation

Moodle publishes security fixes only for its supported release lines. Earlier release lines, including Moodle 4.3 and the IOMAD releases built on it, are End-of-Life and will not receive any public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to Moodle 4.1.21, 4.4.11, 4.5.7, 5.0.3, or later, or to an IOMAD release built on one of those versions.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Paul Holden from Moodle HQ (finder)