CVE-2025-67848
- Source
- https://cve.org/CVERecord?id=CVE-2025-67848
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-67848.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-67848
- Aliases
- Downstream
- Published
- 2026-02-03T11:15:54.107Z
- Modified
- 2026-03-13T03:42:36.967421Z
- Severity
-
- 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- [none]
- Details
-
A flaw was found in Moodle. This authentication bypass vulnerability allows suspended users to authenticate through the Learning Tools Interoperability (LTI) Provider. The issue arises from the LTI authentication handlers failing to enforce the user's suspension status, enabling unauthorized access to the system. This can lead to information disclosure or other unauthorized actions by users who should be restricted.
- References
Affected packages
Git / github.com/moodle/moodle
Affected ranges
- Type
- GIT
- Repo
- https://github.com/moodle/moodle
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroduced0 Unknown introduced commit / All previous commits are affectedLast affected
- Database specific
{ "versions": [ { "introduced": "0" }, { "fixed": "4.1.22" }, { "introduced": "4.4.0" }, { "fixed": "4.4.11" }, { "introduced": "4.5.0" }, { "fixed": "4.5.8" }, { "introduced": "5.0.0" }, { "fixed": "5.0.4" }, { "introduced": "0" }, { "last_affected": "5.1.0-NA" } ] }