CVE-2025-3625: Moodle: user dos and name disclosure via idor in moodle mfa email factor revoke action

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-04-25 · updated 2026-06-17
Weakness: CWE-639

Description

A security vulnerability was discovered in Moodle that can allow hackers to gain access to sensitive information about students and prevent them from logging into their accounts, even after they had completed two-factor authentication (2FA).

Affected products

Moodle: from 4.3.0 before 4.3.12; from 4.4.0 before 4.4.8; from 4.5.0 before 4.5.4 — fixed in 4.3.12, 4.4.8, 4.5.4

How to fix

Upgrade to a fixed version: Moodle 4.3.12, 4.4.8, 4.5.4. Check the vendor advisory for mitigations.

References

https://access.redhat.com/security/cve/CVE-2025-3625
https://bugzilla.redhat.com/show_bug.cgi?id=2359690

Get alerted when CVE-2025-3625 or the next vulnerability affects your stack