CVE-2025-67856: Moodle Badge Awarding Authorization Flaw (CWE-863)
CVE-2025-67856 is an incorrect authorization flaw in Moodle's badge awarding process, where incomplete role checks let badges be granted without proper verification. NVD rates it Critical with a CVSS 3.1 score of 9.8. The CISA KEV catalog does not list it, and no confirmed exploitation appears in the sources consulted.
Overview
Moodle contains an authorization flaw (CWE-863, Incorrect Authorization) in its badge awarding process. Role checks are incomplete, so badges can be granted without proper verification.
Impact
The record states that unauthorized users could obtain badges they are not entitled to, which could lead to privilege escalation or unauthorized access to certain features. NVD scores the vulnerability 9.8 (Critical) under CVSS 3.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CNA score in the record is 5.4.
Affected products and versions
- Product: Moodle Moodle
- Ranges listed in the record: before 4.1.22; 4.4.0 to before 4.4.12; 4.5.0 to before 4.5.8; 5.0.0 to before 5.0.4; and version 5.1.0.
- The record contains no fixed-version field, so fixed releases are not confirmed here.
Exploitation status
The CISA KEV catalog does not list this CVE according to the record. No confirmed exploitation appears in the sources consulted. EPSS and SSVC data are absent.
Remediation and mitigation
- Identify Moodle installations within the listed ranges and plan an update to a release published by the vendor for your branch.
- Until updated, review which roles can influence badge awarding and limit that access to trusted staff.
- Check the vendor release notes for the exact fixed version of each branch, since the record does not provide them.
Detection guidance
- Review badge award logs and recent issuance for awards that lack a clear action by an authorized teacher or administrator.
- Audit recent role and permission changes, and look for unexpected accounts holding badges or elevated access to features.
Limitations of the available information
The record does not state fixed versions, patch details, or the exact vulnerable code path. The NVD and CNA scores differ. The 5.1.0 entry has no range. Exploitation status beyond the sources consulted is unknown.
Frequently asked questions
What does CVE-2025-67856 allow?
According to the record, incomplete role checks in Moodle's badge awarding process allow badges to be granted without proper verification, which could let unauthorized users obtain badges they are not entitled to.
Is this vulnerability being actively exploited?
The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.