CVE-2025-67857

Overview

Moodle is an open source learning management system written in PHP. Schools, universities, and companies use it to run online courses. IOMAD is a multi-tenant distribution of Moodle that lets one installation serve several companies or organizations; it is built on Moodle core and shares the affected code. The assignment activity (mod_assign) supports anonymous submissions, also called blind marking. While blind marking is on, graders see students as Participant N instead of by name, and only users with mod/assign:viewblinddetails can reveal who is who.

An Information Exposure vulnerability (CVE-2025-67857) has been identified in the assignment grading table of Moodle and IOMAD, which exposes students' real user IDs in the submission action links when anonymous submissions are enabled, defeating the anonymity that blind marking is meant to give. Moodle tracks this issue as MSA-25-0061 (MDL-82808).

Per OWASP: Information exposure through query strings in URL is when sensitive data is passed to parameters in the URL. This allows attackers to obtain sensitive data such as usernames, passwords, tokens (authX), database details, and any other potentially sensitive data.

This issue affects all versions of Moodle before 4.1.22, versions 4.2.0 through 4.4.11, versions 4.5.0 through 4.5.7, versions 5.0.0 through 5.0.3, and version 5.1.0, including End-of-Life release lines such as Moodle 4.3. IOMAD releases built on these Moodle versions contain the same code and are affected as well.

Details

Module Info

• Product: Moodle, IOMAD
• Affected packages: moodle/moodle (mod/assign)
• Affected versions: <4.1.22, >=4.2.0 <4.4.12, >=4.5.0 <4.5.8, >=5.0.0 <5.0.4, >=5.1.0 <5.1.1
• GitHub repository: https://github.com/moodle/moodle (Moodle), https://github.com/iomad/iomad (IOMAD)
• Published packages: https://packagist.org/packages/moodle/moodle
• Package manager: Composer
• Fixed in:
  • OSS Moodle 4.1.22, 4.4.12, 4.5.8, 5.0.4, 5.1.1
  • NES for Moodle v4.3.13
  • NES for IOMAD v4.3.4

Vulnerability Info

This Medium-severity vulnerability is found in the moodle/moodle package in all versions before 4.1.22, 4.2.0 through 4.4.11, 4.5.0 through 4.5.7, 5.0.0 through 5.0.3, and 5.1.0 of Moodle, and in IOMAD releases built on those versions. Moodle rates it Minor.

Each row of the submissions table has an action menu with links such as edit submission, prevent submission changes, grant extension, revert to draft, allow another attempt, and remove submission. In mod/assign/gradingtable.php, every one of those links was built from a base URL that carried the student's real user ID:

$baseactionurl = new moodle_url('/mod/assign/view.php', [
    'id' => $this->assignment->get_course_module()->id,
    'userid' => $row->id,
    'sesskey' => sesskey(),
    'page' => $this->currpage,
]);

This code ran whether or not blind marking was on. The table showed Participant N, but the user ID sat in the link targets, where a grader can read it by hovering over a link or viewing the page source. Once a grader follows one of the links, the ID also appears in the address bar, browser history, and server logs. Moodle user IDs map directly to profiles, for example through /user/profile.php?id=, so a grader can match an anonymous submission to a named student. The remove submission confirmation page passed the user ID through to its own confirm link in the same way.

By default, the Teacher and Non-editing teacher roles can grade assignments through mod/assign:grade, while mod/assign:viewblinddetails is granted only to the Manager role. Graders in the default teacher roles are therefore the users who can learn identities that blind marking is meant to hide from them. Assignments that do not use anonymous submissions are not affected.

The fix puts the per-assignment blind ID in these URLs instead of the user ID while blind marking is on:

if ($this->assignment->is_blind_marking()) {
    if (empty($row->recordid)) {
        $row->recordid = $this->assignment->get_uniqueid_for_user($row->userid);
    }
    $urlparams['blindid'] = $row->recordid;
} else {
    $urlparams['userid'] = $row->userid;
}

The handlers in mod/assign/locallib.php for those actions, including addattempt, the remove submission confirmation and removal, revert to draft, lock, and unlock, now accept a blindid parameter and resolve it with get_user_id_for_uniqueid() only when the assignment uses blind marking.

Mitigation

Moodle publishes security fixes only for its supported release lines. Earlier release lines, including Moodle 4.3 and the IOMAD releases built on it, are End-of-Life and will not receive any public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to Moodle 4.1.22, 4.4.12, 4.5.8, 5.0.4, 5.1.1, or later, or to an IOMAD release built on one of those versions.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Mihail Geshoski from Moodle HQ (finder)