CVE-2025-67856

MEDIUM 5.4

Moodle: moodle: privilege escalation via incomplete role checks in badge awarding

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

A flaw was found in Moodle. An authorization logic flaw, specifically due to incomplete role checks during the badge awarding process, allowed badges to be granted without proper verification. This could enable unauthorized users to obtain badges they are not entitled to, potentially leading to privilege escalation or unauthorized access to certain features.

Published	Feb 3, 2026
Last Updated	Feb 26, 2026

Stay Ahead of the Next One

Get instant alerts for

Be the first to know when new medium vulnerabilities are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

References

NVD ↗ CVE.org ↗ EPSS Data ↗

access.redhat.com: https://access.redhat.com/security/cve/CVE-2025-67856 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2423864

Credits

Red Hat would like to thank Stefan Hanauska for reporting this issue.