CVE-2025-62400

Overview

Moodle is an open source learning management system written in PHP. Schools, universities, and companies use it to run online courses. IOMAD is a multi-tenant distribution of Moodle that lets one installation serve several companies or organizations; it is built on Moodle core and shares the affected code. Each course group has a visibility setting. Groups can be visible to everyone, visible only to their members, visible to members without showing other members, or hidden from everyone. Users without the moodle/course:viewhiddengroups capability are not meant to see groups they cannot access.

An Information Exposure vulnerability (CVE-2025-62400) has been identified in the calendar event form of Moodle and IOMAD, which allows a user who can create group calendar events, but cannot view hidden groups, to see the names of every group in the course, including hidden ones. Moodle tracks this issue as MSA-25-0049 (MDL-86261).

Per MITRE CWE-200: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

This issue affects all versions of Moodle before 4.1.21, versions 4.2.0 through 4.4.10, versions 4.5.0 through 4.5.6, and versions 5.0.0 through 5.0.2, including End-of-Life release lines such as Moodle 4.3. IOMAD releases built on these Moodle versions contain the same code and are affected as well.

Details

Module Info

• Product: Moodle, IOMAD
• Affected packages: moodle/moodle (calendar)
• Affected versions: <4.1.21, >=4.2.0 <4.4.11, >=4.5.0 <4.5.7, >=5.0.0 <5.0.3
• GitHub repository: https://github.com/moodle/moodle (Moodle), https://github.com/iomad/iomad (IOMAD)
• Published packages: https://packagist.org/packages/moodle/moodle
• Package manager: Composer
• Fixed in:
  • OSS Moodle 4.1.21, 4.4.11, 4.5.7, 5.0.3
  • NES for Moodle v4.3.13
  • NES for IOMAD v4.3.4

Vulnerability Info

This Medium-severity vulnerability is found in the moodle/moodle package in all versions before 4.1.21, 4.2.0 through 4.4.10, 4.5.0 through 4.5.6, and 5.0.0 through 5.0.2 of Moodle, and in IOMAD releases built on those versions. Moodle rates it Minor.

When a user creates or edits a calendar event in a course, the form offers a list of groups for group events. calendar_output_fragment_event_form() in calendar/lib.php built that list from the cached course group data:

if (!empty($courseid)) {
    $groupcoursedata = groups_get_course_data($courseid);
    $formoptions['groups'] = [];
    foreach ($groupcoursedata->groups as $groupid => $groupdata) {
        $formoptions['groups'][$groupid] = format_string($groupdata->name, false, ['context' => $context]);
    }
}

groups_get_course_data() returns every group in the course and applies no visibility rules. core_calendar_external::submit_create_update_form() in calendar/externallib.php built the form's group options the same way when the form is submitted through the web service.

A user who can create group events in a course, which requires moodle/calendar:manageentries or moodle/calendar:managegroupentries, therefore saw the names of all groups in the course, including groups whose visibility setting hides them from that user. Group names can reveal sensitive information about the members, such as support or accommodation groups.

By default, both calendar capabilities and moodle/course:viewhiddengroups are granted to the same roles (Teacher, Non-editing teacher, and Manager), so users who hold only the default roles are not exposed. The exposure applies to custom roles or role overrides that allow event creation without moodle/course:viewhiddengroups.

The fix replaces groups_get_course_data() with groups_get_all_groups() in both places. For a user without moodle/course:viewhiddengroups, groups_get_all_groups() returns only groups that are visible to everyone and groups with member-only visibility that the user belongs to:

$groupcoursedata = groups_get_all_groups($courseid);
$formoptions['groups'] = [];
foreach ($groupcoursedata as $groupid => $groupdata) {
    $formoptions['groups'][$groupid] = format_string($groupdata->name, false, ['context' => $context]);
}

Mitigation

Moodle publishes security fixes only for its supported release lines. Earlier release lines, including Moodle 4.3 and the IOMAD releases built on it, are End-of-Life and will not receive any public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to Moodle 4.1.21, 4.4.11, 4.5.7, 5.0.3, or later, or to an IOMAD release built on one of those versions.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Robert Toth (finder)