CVE-2025-26526
📋 TL;DR
This vulnerability allows users to bypass Separate Groups mode restrictions in Moodle's Feedback activities, enabling unauthorized viewing or deletion of responses. It affects Moodle installations using Feedback activities with Separate Groups mode configured. Users with appropriate permissions but not in the same group can exploit this flaw.
💻 Affected Systems
- Moodle
📦 What is this software?
Moodle by Moodle
Moodle by Moodle
Moodle by Moodle
Moodle by Moodle
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized users could view or delete sensitive feedback responses from other groups, potentially exposing confidential information or disrupting educational activities.
Likely Case
Users with Feedback activity permissions could accidentally or intentionally access responses from groups they shouldn't have access to, violating privacy expectations.
If Mitigated
With proper access controls and monitoring, impact is limited to minor privacy violations that can be detected and corrected.
🎯 Exploit Status
Exploitation requires authenticated user with appropriate Feedback permissions. Attack involves navigating to Feedback activities and accessing responses from other groups.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in Moodle 4.3.6, 4.2.12, 4.1.15, 4.0.19
Vendor Advisory: https://moodle.org/mod/forum/discuss.php?d=466142
Restart Required: No
Instructions:
1. Backup your Moodle installation and database. 2. Upgrade to patched version: Moodle 4.3.6, 4.2.12, 4.1.15, or 4.0.19. 3. Apply the patch from git.moodle.org if manual patching is needed. 4. Clear Moodle caches after upgrade.
🔧 Temporary Workarounds
Disable Separate Groups Mode
allTemporarily disable Separate Groups mode for Feedback activities to prevent exploitation
Navigate to Feedback activity settings > Group mode > Select 'No groups'
Restrict Feedback Permissions
allTemporarily remove view/delete permissions for Feedback activities from non-essential users
Navigate to Site administration > Users > Permissions > Define roles > Edit role capabilities for Feedback module
🧯 If You Can't Patch
- Disable Separate Groups mode for all Feedback activities
- Implement additional access logging for Feedback activities and monitor for unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Check Moodle version in Site administration > Notifications. If using affected versions (4.3.0-4.3.5, 4.2.0-4.2.11, 4.1.0-4.1.14, 4.0.0-4.0.18) with Feedback activities using Separate Groups mode, you are vulnerable.Check Version:
Check Moodle version via Site administration > Notifications or examine version.php fileVerify Fix Applied:
After patching, test that users cannot view or delete Feedback responses from groups they don't belong to when Separate Groups mode is enabled.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to Feedback activities
- Users accessing Feedback responses from multiple groups
- Failed permission checks in Moodle logs
Network Indicators:
- Increased requests to feedback modules from single users across different group contexts
SIEM Query:
source="moodle_logs" AND (event="feedback_view" OR event="feedback_delete") AND user_group_changes=true