CVE-2025-67856 MEDIUM

CVE-2025-67856: Moodle: moodle: privilege escalation via incomplete role checks in badge awarding

Published February 3, 2026
Last update February 26, 2026

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

A flaw was found in Moodle. An authorization logic flaw, specifically due to incomplete role checks during the badge awarding process, allowed badges to be granted without proper verification. This could enable unauthorized users to obtain badges they are not entitled to, potentially leading to privilege escalation or unauthorized access to certain features.

Key dates

02Disclosure timeline

February 3, 2026 CVE published
February 26, 2026 Record updated