CVE-2021-20282

Moodle Bypass email verification secret when confirming account registration

5.3 MediumFix available

When creating a user account, it was possible to verify the account without having access to the verification email link/secret in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

1.32%Up 0.1 points since Apr 14, 2021

What each source reports

NVD Score used 5.3

When creating a user account, it was possible to verify the account without having access to the verification email link/secret in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

Record: CVE-2021-20282
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness: CWE-863
Updated: 2026-11-02

CVE List No score

When creating a user account, it was possible to verify the account without having access to the verification email link/secret in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

Record: CVE-2021-20282
Weakness: CWE-863
Updated: 2026-11-02

EUVDEUVD-2022-4000 No score

When creating a user account, it was possible to verify the account without having access to the verification email link/secret in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

Record: EUVD-2022-4000
Updated: 2026-11-03

GitHub AdvisoriesGHSA-grj4-g57c-9xmv 5.3

Moodle Bypass email verification secret when confirming account registration

When creating a user account, it was possible to verify the account without having access to the verification email link/secret in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

Record: GHSA-grj4-g57c-9xmv
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-863
Updated: 2026-11-02

OSV 5.3

When creating a user account, it was possible to verify the account without having access to the verification email link/secret in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

Record: CVE-2021-20282
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVGHSA-grj4-g57c-9xmv 5.3

Moodle Bypass email verification secret when confirming account registration

When creating a user account, it was possible to verify the account without having access to the verification email link/secret in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

Record: GHSA-grj4-g57c-9xmv
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-863
Updated: 2026-11-02

OSVUBUNTU-CVE-2021-20282 5.3

When creating a user account, it was possible to verify the account without having access to the verification email link/secret in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

Record: UBUNTU-CVE-2021-20282
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVBIT-moodle-2021-20282 No score

When creating a user account, it was possible to verify the account without having access to the verification email link/secret in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

Record: BIT-moodle-2021-20282
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`moodle/moodle` Packagist	3.5 up to 3.5.17	3.5.17
`moodle/moodle` Packagist	3.8 up to 3.8.8	3.8.8
`moodle/moodle` Packagist	3.9 up to 3.9.5	3.9.5
`moodle/moodle` Packagist	3.10 up to 3.10.2	3.10.2
`moodle` Bitnami	3.5.0 up to 3.5.17, 3.8.0 up to 3.8.8, 3.9.0 up to 3.9.5, 3.10.0 up to 3.10.2	3.5.173.8.83.9.53.10.2
`moodle/moodle` Packagist	3.5 up to 3.5.17, plus listed versions v3.5.0v3.5.0-betav3.5.0-rc1v3.5.1v3.5.10 Show 14 moreShow less v3.5.11v3.5.12v3.5.13v3.5.14v3.5.15v3.5.16v3.5.2v3.5.3v3.5.4v3.5.5v3.5.6v3.5.7v3.5.8v3.5.9	3.5.17
`moodle/moodle` Packagist	3.8 up to 3.8.8, plus listed versions v3.8.0v3.8.0-betav3.8.0-rc1v3.8.1v3.8.2 Show 5 moreShow less v3.8.3v3.8.4v3.8.5v3.8.6v3.8.7	3.8.8
`moodle/moodle` Packagist	3.9 up to 3.9.5, plus listed versions v3.9.0v3.9.0-betav3.9.0-rc1v3.9.0-rc2v3.9.0-rc3 Show 4 moreShow less v3.9.1v3.9.2v3.9.3v3.9.4	3.9.5
`moodle/moodle` Packagist	3.10 up to 3.10.2, plus listed versions v3.10.0v3.10.0-betav3.10.0-rc1v3.10.0-rc2v3.10.1	3.10.2
`moodle` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 2.7.9+dfsg-12.7.10+dfsg-12.7.11+dfsg-12.7.11+dfsg-22.7.12+dfsg-13.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1	None known
`moodle` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 3.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-20282 is a medium vulnerability (CVSS 5.3) in Moodle, published March 15, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.32%, the 70th percentile. Fixed in moodle/moodle 3.5.17.

References

Show 5 moreShow less