CVE-2025-62394
📋 TL;DR
Moodle fails to properly verify user enrolment status when sending quiz notifications, allowing suspended or inactive users to receive quiz-related messages. This leaks limited course information to unauthorized users. All Moodle instances with quiz functionality are affected.
💻 Affected Systems
- Moodle
📦 What is this software?
Moodle by Moodle
Moodle by Moodle
⚠️ Risk & Real-World Impact
Worst Case
Suspended users receive ongoing course notifications, potentially accessing quiz details, deadlines, and limited course metadata they shouldn't see.
Likely Case
Inactive or suspended users receive occasional quiz notifications containing basic course information like quiz names and dates.
If Mitigated
No information leakage occurs as proper enrolment checks prevent unauthorized notifications.
🎯 Exploit Status
Requires user account with suspended/inactive status and quiz notifications to be triggered
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Moodle security advisories for specific patched version
Vendor Advisory: https://moodle.org/security/
Restart Required: No
Instructions:
1. Check Moodle security advisory for CVE-2025-62394. 2. Update to patched version. 3. Verify enrolment verification in quiz notification code.
🔧 Temporary Workarounds
Disable quiz notifications
allTemporarily disable quiz-related notifications system-wide
Navigate to Site administration > Messaging > Notification settings
Review user enrolment statuses
allAudit and properly manage user enrolment statuses
Check user enrolment reports and ensure proper suspension procedures
🧯 If You Can't Patch
- Implement manual enrolment status verification in notification workflows
- Monitor notification logs for suspicious activity involving suspended users
🔍 How to Verify
Check if Vulnerable:
Test by suspending a user, creating a quiz notification, and checking if they receive itCheck Version:
Check Moodle version in Site administration > NotificationsVerify Fix Applied:
After patching, repeat the test to confirm suspended users no longer receive notifications📡 Detection & Monitoring
Log Indicators:
- Notifications sent to suspended/inactive users
- Quiz notifications with unusual recipient patterns
Network Indicators:
- Email notifications to users who shouldn't have access
SIEM Query:
Search for 'quiz notification' AND 'suspended user' in Moodle logs