CVE-2025-62437

Overview

Moodle is an open source learning management system written in PHP. Schools, universities, and companies use it to run online courses. IOMAD is a multi-tenant distribution of Moodle that lets one installation serve several companies or organizations; it is built on Moodle core and shares the affected code. The Feedback activity (mod_feedback) lets teachers build surveys and review the answers. Teachers with the mod/feedback:viewreports capability can open the list of responses and the list of users who have not responded. When the activity uses Separate Groups mode, teachers who cannot access all groups are meant to see only their own groups.

An Improper Access Control vulnerability (CVE-2025-62437) has been identified in the Feedback activity of Moodle and IOMAD, which allows a non-editing teacher who is not a member of any group to view the Feedback responses and non-respondents of every group in a Separate Groups activity. Moodle tracks this issue as MSA-25-0039 (MDL-84463).

Per MITRE CWE-284: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

This issue affects all versions of Moodle before 4.1.20, versions 4.2.0 through 4.4.9, versions 4.5.0 through 4.5.5, and versions 5.0.0 through 5.0.1, including End-of-Life release lines such as Moodle 4.3. IOMAD releases built on these Moodle versions contain the same code and are affected as well.

Details

Module Info

• Product: Moodle, IOMAD
• Affected packages: moodle/moodle (mod/feedback)
• Affected versions: <4.1.20, >=4.2.0 <4.4.10, >=4.5.0 <4.5.6, >=5.0.0 <5.0.2
• GitHub repository: https://github.com/moodle/moodle (Moodle), https://github.com/iomad/iomad (IOMAD)
• Published packages: https://packagist.org/packages/moodle/moodle
• Package manager: Composer
• Fixed in:
  • OSS Moodle 4.1.20, 4.4.10, 4.5.6, 5.0.2
  • NES for Moodle v4.3.13
  • NES for IOMAD v4.3.4

Vulnerability Info

This Low-severity vulnerability is found in the moodle/moodle package in all versions before 4.1.20, 4.2.0 through 4.4.9, 4.5.0 through 4.5.5, and 5.0.0 through 5.0.1 of Moodle, and in IOMAD releases built on those versions. Moodle rates it Minor.

The Feedback response tables filter users by the active group that groups_get_activity_group() returns. That function documents that a return value of 0 means all groups and that the caller must still verify access in Separate Groups mode:

/**
 * Returns group active in activity, changes the group by default if 'group' page param present
 *
 * @category group
 * @param stdClass|cm_info $cm course module object
 * @param bool $update change active group if group param submitted
 * @param array $allowedgroups list of groups user may access (INTERNAL, to be used only from groups_print_activity_menu())
 * @return mixed false if groups not used, int if groups used, 0 means all groups (access must be verified in SEPARATE mode)
 */
function groups_get_activity_group($cm, $update=false, $allowedgroups=null) {

When a user without moodle/site:accessallgroups belongs to no group in a Separate Groups activity, Moodle sets that user's active group to 0. The responses table in mod/feedback/classes/responses_table.php then adds no group filter at all:

$group = (empty($group)) ? groups_get_activity_group($this->feedbackstructure->get_cm(), true) : $group;
if ($group) {
    $where .= ' AND c.userid IN (SELECT g.userid FROM {groups_members} g WHERE g.groupid = :group)';
    $params['group'] = $group;
}

Neither show_entries.php nor show_nonrespondents.php checked for this case, so a teacher in no group was shown every response and every non-respondent in the activity, across all groups. The same gap affected submission notifications: when a user in no group submitted a response, every user with mod/feedback:receivemail was notified, including teachers who should not see users outside their groups.

By default, mod/feedback:viewreports is granted to the Teacher, Non-editing teacher, and Manager roles, while moodle/site:accessallgroups is granted only to Teacher and Manager. The default exposure is therefore limited to non-editing teachers who are not in any group of a course or activity in Separate Groups mode. They can read the responses of students in every group and see which students in every group have not responded. Teachers who can access all groups and activities that do not use Separate Groups mode are not affected.

The fix adds mod_feedback\manager::can_see_others_in_groups():

public static function can_see_others_in_groups(cm_info $cm): bool {
    $canaccessallgroups = has_capability('moodle/site:accessallgroups', $cm->context);
    if ($canaccessallgroups) {
        return true;
    }
    $course = $cm->get_course();
    $groupmode = groups_get_activity_groupmode($cm, $course);
    $usergroups = groups_get_user_groups($course->id);
    return ($groupmode != SEPARATEGROUPS || !empty($usergroups['0']));
}

show_entries.php and show_nonrespondents.php now stop with a notingroup message when it returns false, and the Analysis and Responses navigation entries are hidden for those users. feedback_get_receivemail_users() now limits notifications about submissions from users in no group to recipients who can access all groups.

Mitigation

Moodle publishes security fixes only for its supported release lines. Earlier release lines, including Moodle 4.3 and the IOMAD releases built on it, are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, sites can make sure that every non-editing teacher in a course that uses Separate Groups mode belongs to a group, or remove the mod/feedback:viewreports capability from the Non-editing teacher role.

Users of the affected components should apply one of the following mitigations:

• Upgrade to Moodle 4.1.20, 4.4.10, 4.5.6, 5.0.2, or later, or to an IOMAD release built on one of those versions.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Sara Arjona from Moodle HQ (finder)