CVE-2025-62436

Overview

Moodle is an open source learning management system written in PHP. Schools, universities, and companies use it to run online courses. IOMAD is a multi-tenant distribution of Moodle that lets one installation serve several companies or organizations; it is built on Moodle core and shares the affected code. The Logs report (report_log) and the Live logs report (report_loglive) list the actions recorded in a course, such as page views, submissions, and posts, along with the user who performed each one. When a course uses Separate Groups mode, teachers who cannot access all groups are meant to see only the activity of their own groups.

An Improper Access Control vulnerability (CVE-2025-62436) has been identified in the course Logs and Live logs reports of Moodle and IOMAD, which allows a teacher who is not a member of any group in a Separate Groups course to view logged activity of other course participants that Separate Groups mode should hide from them. Moodle tracks this issue as MSA-25-0038 (MDL-84464).

Per MITRE CWE-284: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

This issue affects all versions of Moodle before 4.1.20, versions 4.2.0 through 4.4.9, versions 4.5.0 through 4.5.5, and versions 5.0.0 through 5.0.1, including End-of-Life release lines such as Moodle 4.3. IOMAD releases built on these Moodle versions contain the same code and are affected as well.

Details

Module Info

• Product: Moodle, IOMAD
• Affected packages: moodle/moodle (report/log, report/loglive, lib/classes/report_helper.php)
• Affected versions: <4.1.20, >=4.2.0 <4.4.10, >=4.5.0 <4.5.6, >=5.0.0 <5.0.2
• GitHub repository: https://github.com/moodle/moodle (Moodle), https://github.com/iomad/iomad (IOMAD)
• Published packages: https://packagist.org/packages/moodle/moodle
• Package manager: Composer
• Fixed in:
  • OSS Moodle 4.1.20, 4.4.10, 4.5.6, 5.0.2
  • NES for Moodle v4.3.13
  • NES for IOMAD v4.3.4

Vulnerability Info

This Low-severity vulnerability is found in the moodle/moodle package in all versions before 4.1.20, 4.2.0 through 4.4.9, 4.5.0 through 4.5.5, and 5.0.0 through 5.0.1 of Moodle, and in IOMAD releases built on those versions. Moodle rates it Minor.

In Separate Groups mode, Moodle expects each page that lists other users' data to check whether the viewer can see all groups (moodle/site:accessallgroups) and, if not, which groups the viewer belongs to. A user who belongs to no group is a special case that each page has to handle. The core group API says so in the comment on the code that picks a user's active group:

} else {
    // this happen when user not assigned into group in SEPARATEGROUPS mode or groups do not exist yet
    // mod authors must add extra checks for this when SEPARATEGROUPS mode used (such as when posting to forum)
    $SESSION->activegroup[$courseid][$groupmode][$groupingid] = 0;

The log report pages did not handle that case. Access to the Live logs page, for example, depended only on the report capability:

} else {
    $course = get_course($id);
    require_login($course);
    $context = context_course::instance($course->id);
    $coursename = format_string($course->fullname, true, array('context' => $context));
}
require_capability('report/loglive:view', $context);

The Logs page and the course and activity navigation links used the same capability-only test with report/log:view. Neither report checked whether a teacher without moodle/site:accessallgroups belonged to a group before showing the report. Moodle's advisory states that, as a result, the Logs report displayed the actions of all course participants to such a teacher.

By default, report/log:view and report/loglive:view are granted to the Teacher, Non-editing teacher, and Manager roles, but moodle/site:accessallgroups is granted only to Teacher and Manager. As Moodle's advisory notes, this means the default exposure is limited to non-editing teachers who have not been placed in a group in a course that uses Separate Groups mode. They can see which users did what in the course, and when. Teachers who can access all groups, and courses that do not use Separate Groups mode, are not affected.

The fix adds core\report_helper::has_valid_group(), which returns false when the context uses Separate Groups mode and the user neither can access all groups nor belongs to any group:

if ($groupmode != SEPARATEGROUPS) {
    return true; // No groups or visible all groups.
}

if (!has_capability('moodle/site:accessallgroups', $context, $userid)) {
    $usergroups = groups_get_all_groups($courseid, $userid);
    if (empty($usergroups)) {
        return false;
    }
}

Both report pages now call it before building the report and show a notingroup message instead, and the navigation callbacks for both reports hide the report links for such users.

Mitigation

Moodle publishes security fixes only for its supported release lines. Earlier release lines, including Moodle 4.3 and the IOMAD releases built on it, are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, sites can make sure that every non-editing teacher in a course that uses Separate Groups mode belongs to a group, or remove the report/log:view and report/loglive:view capabilities from the Non-editing teacher role.

Users of the affected components should apply one of the following mitigations:

• Upgrade to Moodle 4.1.20, 4.4.10, 4.5.6, 5.0.2, or later, or to an IOMAD release built on one of those versions.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Sara Arjona from Moodle HQ (finder)