CVE-2025-62393
Moodle: course access permissions not properly checked in course_output_fragment_course_overview
A flaw was found in the course overview output function where user access permissions were not fully enforced. This could allow unauthorized users to view information about courses they should not have access to, potentially exposing limited course details.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Moodle: course access permissions not properly checked in course_output_fragment_course_overview
A flaw was found in the course overview output function where user access permissions were not fully enforced. This could allow unauthorized users to view information about courses they should not have access to, potentially exposing limited course details.
- Record
CVE-2025-62393- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
EUVDEUVD-2025-35673
A flaw was found in the course overview output function where user access permissions were not fully enforced. This could allow unauthorized users to view information about courses they should not have access to, potentially exposing limited course details.
- Record
EUVD-2025-35673- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rjcm-7v2p-9265
Moodle course access permissions are not properly checked in course_output_fragment_course_overview
A flaw was found in the course overview output function where user access permissions were not fully enforced. This could allow unauthorized users to view information about courses they should not have access to, potentially exposing limited course details.
- Record
GHSA-rjcm-7v2p-9265- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
NVD
A flaw was found in the course overview output function where user access permissions were not fully enforced. This could allow unauthorized users to view information about courses they should not have access to, potentially exposing limited course details.
- Record
CVE-2025-62393- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSV
Moodle: course access permissions not properly checked in course_output_fragment_course_overview
A flaw was found in the course overview output function where user access permissions were not fully enforced. This could allow unauthorized users to view information about courses they should not have access to, potentially exposing limited course details.
- Record
CVE-2025-62393- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVGHSA-rjcm-7v2p-9265
Moodle course access permissions are not properly checked in course_output_fragment_course_overview
A flaw was found in the course overview output function where user access permissions were not fully enforced. This could allow unauthorized users to view information about courses they should not have access to, potentially exposing limited course details.
- Record
GHSA-rjcm-7v2p-9265- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-62393
A flaw was found in the course overview output function where user access permissions were not fully enforced. This could allow unauthorized users to view information about courses they should not have access to, potentially exposing limited course details.
- Record
UBUNTU-CVE-2025-62393- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVBIT-moodle-2025-62393 No score
Moodle: course access permissions not properly checked in course_output_fragment_course_overview
A flaw was found in the course overview output function where user access permissions were not fully enforced. This could allow unauthorized users to view information about courses they should not have access to, potentially exposing limited course details.
- Record
BIT-moodle-2025-62393- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
moodle/moodlePackagist |
5.0.0-beta up to 5.0.3 | 5.0.3 |
moodleBitnami |
5.0.0 up to 5.0.3 | 5.0.3 |
moodle/moodlePackagist |
5.0.0-beta up to 5.0.3, plus listed versions v5.0.0v5.0.0-betav5.0.0-rc1v5.0.0-rc2v5.0.0-rc3v5.0.1v5.0.2 |
5.0.3 |
moodleUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.7.9+dfsg-12.7.10+dfsg-12.7.11+dfsg-12.7.11+dfsg-22.7.12+dfsg-13.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1 |
None known |
moodleUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-62393 is a medium vulnerability (CVSS 4.3) in Moodle, published October 23, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. Fixed in moodle/moodle 5.0.3.