CVE-2024-48898
Moodle: some users can delete audiences of other reports
A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they do not have permission to delete from.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they do not have permission to delete from.
- Record
CVE-2024-48898- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
CVE List
Moodle: some users can delete audiences of other reports
A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they do not have permission to delete from.
- Record
CVE-2024-48898- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
EUVDEUVD-2024-3245
A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they do not have permission to delete from.
- Record
EUVD-2024-3245- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fjq9-452g-jg3q
moodle: Some users can delete audiences of other reports
A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they do not have permission to delete from.
- Record
GHSA-fjq9-452g-jg3q- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSV
Moodle: some users can delete audiences of other reports
A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they do not have permission to delete from.
- Record
CVE-2024-48898- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSVGHSA-fjq9-452g-jg3q
moodle: Some users can delete audiences of other reports
A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they do not have permission to delete from.
- Record
GHSA-fjq9-452g-jg3q- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-48898
A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they do not have permission to delete from.
- Record
UBUNTU-CVE-2024-48898- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVBIT-moodle-2024-48898 No score
Moodle: some users can delete audiences of other reports
A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they do not have permission to delete from.
- Record
BIT-moodle-2024-48898- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
moodle/moodlePackagist |
before 4.1.14 | 4.1.14 |
moodle/moodlePackagist |
4.2.0 up to 4.2.11 | 4.2.11 |
moodle/moodlePackagist |
4.3.0 up to 4.3.8 | 4.3.8 |
moodle/moodlePackagist |
4.4.0 up to 4.4.4 | 4.4.4 |
moodleBitnami |
before 4.1.19, 4.2.0 up to 4.4.9 | 4.1.194.4.9 |
moodle/moodlePackagist |
before 4.1.14, plus listed versions v2.3.10v2.3.11v2.3.4v2.3.5v2.3.6 Show 45 moreShow lessv2.3.7v2.3.8v2.3.9v2.4.0v2.4.0-rc1v2.4.1v2.4.10v2.4.11v2.4.2v2.4.3v2.4.4v2.4.5v2.4.6v2.4.7v2.4.8v2.4.9v2.5.0v2.5.0-betav2.5.0-rc1v2.5.1v2.5.2v2.5.3v2.5.4v2.5.5v2.5.6v2.5.7v2.5.8v2.5.9v2.6.0v2.6.0-betav2.6.0-rc1v2.6.1v2.6.10v2.6.11v2.6.2v2.6.3v2.6.4v2.6.5v2.6.6v2.6.7v2.6.8v2.6.9v2.7.0v2.7.0-betav2.7.0-rc1 |
4.1.14 |
moodle/moodlePackagist |
4.2.0 up to 4.2.11, plus listed versions v4.2.0v4.2.1v4.2.10v4.2.2v4.2.3 Show 6 moreShow lessv4.2.4v4.2.5v4.2.6v4.2.7v4.2.8v4.2.9 |
4.2.11 |
moodle/moodlePackagist |
4.3.0 up to 4.3.8, plus listed versions v4.3.0v4.3.1v4.3.2v4.3.3v4.3.4v4.3.5v4.3.6v4.3.7 |
4.3.8 |
moodle/moodlePackagist |
4.4.0 up to 4.4.4, plus listed versions v4.4.0v4.4.1v4.4.2v4.4.3 |
4.4.4 |
moodleUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.7.9+dfsg-12.7.10+dfsg-12.7.11+dfsg-12.7.11+dfsg-22.7.12+dfsg-13.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1 |
None known |
moodleUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-48898 is a medium vulnerability (CVSS 4.3) in Moodle, published November 18, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. Fixed in moodle/moodle 4.1.14.
References
bugzilla.redhat.com/show_bug.cgi?id=2318820
nvd.nist.gov/vuln/detail/CVE-2024-48898
github.com/advisories/GHSA-fjq9-452g-jg3q
moodle.org
ubuntu.com/security/CVE-2024-48898
cve.org/CVERecord?id=CVE-2024-48898
Left out here: 296 versions. The JSON record has them.