CVE-2025-62400: Moodle: hidden group names visible to event creators

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-23 · updated 2026-06-17
Weakness: CWE-200

Description

Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups. This could reveal private or restricted group information.

Affected products

Moodle: from 4.1.0 before 4.1.21; from 4.4.0 before 4.4.11; from 4.5.0 before 4.5.7; from 5.0.0 before 5.0.3 — fixed in 4.1.21, 4.4.11, 4.5.7, 5.0.3

How to fix

Upgrade to a fixed version: Moodle 4.1.21, 4.4.11, 4.5.7, 5.0.3. Check the vendor advisory for mitigations.

References

https://access.redhat.com/security/cve/CVE-2025-62400
https://bugzilla.redhat.com/show_bug.cgi?id=2404433

Get alerted when CVE-2025-62400 or the next vulnerability affects your stack