CVE-2025-67854

Overview

Moodle is an open source learning management system written in PHP. Schools, universities, and companies use it to run online courses. IOMAD is a multi-tenant distribution of Moodle that lets one installation serve several companies or organizations; it is built on Moodle core and shares the affected code. The forum, database and glossary activities can let participants rate posts and entries, and each activity has its own capabilities that decide who may see their own ratings and who may see every individual rating.

An Improper Access Control vulnerability (CVE-2025-67854) has been identified in the rating code of the forum, database and glossary activities in Moodle and IOMAD, which allows participants to see the individual ratings given to posts and entries even when the activity's capabilities do not allow it. Moodle tracks this issue as MSA-25-0058 (MDL-86960).

Per MITRE CWE-862: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

This issue affects all versions of Moodle before 4.1.22, versions 4.2.0 through 4.4.11, versions 4.5.0 through 4.5.7, versions 5.0.0 through 5.0.3, and version 5.1.0, including End-of-Life release lines such as Moodle 4.3. IOMAD releases built on these Moodle versions contain the same code and are affected as well.

Details

Module Info

• Product: Moodle, IOMAD
• Affected packages: moodle/moodle (mod/forum, mod/data, mod/glossary)
• Affected versions: <4.1.22, >=4.2.0 <4.4.12, >=4.5.0 <4.5.8, >=5.0.0 <5.0.4, >=5.1.0 <5.1.1
• GitHub repository: https://github.com/moodle/moodle (Moodle), https://github.com/iomad/iomad (IOMAD)
• Published packages: https://packagist.org/packages/moodle/moodle
• Package manager: Composer
• Fixed in:
  • OSS Moodle 4.1.22, 4.4.12, 4.5.8, 5.0.4, 5.1.1
  • NES for Moodle v4.3.13
  • NES for IOMAD v4.3.4

Vulnerability Info

This Low-severity vulnerability is found in the moodle/moodle package in all versions before 4.1.22, 4.2.0 through 4.4.11, 4.5.0 through 4.5.7, 5.0.0 through 5.0.3, and 5.1.0 of Moodle, and in IOMAD releases built on those versions. Moodle rates it Minor.

The rating list page, rating/index.php, shows who rated an item, the rating they gave, and when. It checks the core moodle/rating:view capability and then asks the activity, through its rating_can_see_item_ratings callback, whether the user may see the ratings for that item. If the activity has no callback, the answer defaults to yes:

if (!has_capability('moodle/rating:view', $context) ||
        !component_callback($component, 'rating_can_see_item_ratings', array($params), true)) {
    throw new \moodle_exception('noviewrate', 'rating');
}

By default the core moodle/rating:view and moodle/rating:viewall capabilities are granted to students, while the activity capabilities, such as mod/forum:viewallratings, are granted only to teachers and managers. The callbacks were supposed to apply those activity capabilities, but they did not. The forum callback only checked that the user could see the post:

// Perform some final capability checks.
if (!forum_user_can_see_post($forum, $discussion, $post, $USER, $cm)) {
    return false;
}

return true;

The database activity's callback only checked group visibility, and the glossary activity had no callback at all. A student could therefore open the rating list for a post or entry written by someone else and see each rater's name, rating and time, even though the activity's settings meant they should not see other users' individual ratings. The issue exposes rating information only; it does not let anyone change ratings or grades.

The fix makes all three callbacks check the activity's own rating permissions, requiring the view permission for the user's own items and viewall for items written by others. In the forum:

$context = context_module::instance($cm->id);
$ratingpermissions = forum_rating_permissions($context->id, 'mod_forum', 'post');
$requiredpermission = ($post->userid != $USER->id) ? 'viewall' : 'view';
if (!$ratingpermissions[$requiredpermission]) {
    return false;
}

The database activity's callback gets the same check, and the glossary activity gains a mod_glossary_rating_can_see_item_ratings() callback that applies it and also confirms the user can view the entry.

Mitigation

Moodle publishes security fixes only for its supported release lines. Earlier release lines, including Moodle 4.3 and the IOMAD releases built on it, are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, administrators can remove the moodle/rating:viewall capability from the student and authenticated user roles, or override it in courses that use ratings, so that the rating list page shows students only their own ratings.

Users of the affected components should apply one of the following mitigations:

• Upgrade to Moodle 4.1.22, 4.4.12, 4.5.8, 5.0.4, 5.1.1, or later, or to an IOMAD release built on one of those versions.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Stefan Hanauska (finder)