CVE-2025-67848 HIGH

CVE-2025-67848: Moodle: moodle: authentication bypass via lti provider allows suspended users to gain unauthorized access.

Weakness CWE-280
Published February 3, 2026
Last update February 26, 2026

CVSS base score

8.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

A flaw was found in Moodle. This authentication bypass vulnerability allows suspended users to authenticate through the Learning Tools Interoperability (LTI) Provider. The issue arises from the LTI authentication handlers failing to enforce the user's suspension status, enabling unauthorized access to the system. This can lead to information disclosure or other unauthorized actions by users who should be restricted.

Key dates

02Disclosure timeline

February 3, 2026 CVE published
February 26, 2026 Record updated