Medium
Moodle: moodle: data exposure of user identifiers in urls
Type: advisorySources: OSV
A flaw was found in moodle. During anonymous assignment submissions, user identifiers were inadvertently exposed in URLs. This data exposure allows unauthorized viewers to see internal user IDs, compromising the intended anonymity and potentially leading to information disclosure.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-67857
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 17:44 UTC · Revision 1
Source evidence
Moodle: moodle: data exposure of user identifiers in urls
core-osv · Original sourcePublished 3 Feb 2026, 10:52 UTC
A flaw was found in moodle. During anonymous assignment submissions, user identifiers were inadvertently exposed in URLs. This data exposure allows unauthorized viewers to see internal user IDs, compromising the intended anonymity and potentially leading to information disclosure.
osv:CVE-2025-67857
Complete source record
{
"id": "31fdec1ca5492a6bf543bb5b25d2c2d99d4722c1aa03cba9719d03f56c7adf8a",
"url": "https://osv.dev/vulnerability/CVE-2025-67857",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Moodle: moodle: data exposure of user identifiers in urls",
"summary": "A flaw was found in moodle. During anonymous assignment submissions, user identifiers were inadvertently exposed in URLs. This data exposure allows unauthorized viewers to see internal user IDs, compromising the intended anonymity and potentially leading to information disclosure.",
"evidence": "osv:CVE-2025-67857",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2025-67857",
"aliases": [
"BIT-moodle-2025-67857",
"CVE-2025-67857",
"GHSA-8jrv-wx83-w3xj"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/moodle/moodle",
"type": "GIT",
"events": [
{
"introduced": "0ea3d45e04c3d54a3a472ddcb11606b30e227c50"
},
{
"fixed": "df1157bb845eabedd31989d6a1a6e18f638ff890"
},
{
"introduced": "ee91c6536f99e1633e2245780c4fe7f47340ed66"
},
{
"fixed": "ca15d0f2e8f29ca605dfff2e05e098db3d461425"
},
{
"introduced": "52c0da7c647bd6ba8c5f61882d88959821a1fb41"
},
{
"fixed": "48c9857449da61ee1efa89e679c30efb58d72484"
},
{
"introduced": "78e860178314c45441a21e0b99455400b8283d48"
},
{
"fixed": "a5b3ac7e43c082e6cb24a6094810735a945ff32e"
},
{
"introduced": "eb47eff0719455a7e1f7a9805bc75dad3f6b3995"
},
{
"fixed": "a3a086d670fc08507853c594042f266b2dd6f613"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "4.1.0"
},
{
"fixed": "4.1.22"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "4.4.0"
},
{
"fixed": "4.4.12"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "4.5.0"
},
{
"fixed": "4.5.8"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.0.4"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "5.1.0"
},
{
"fixed": "5.1.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
}
],
"versions": [
"5.1.0-NA",
"v4.1.21",
"v4.4.11",
"v4.5.7",
"v5.1.0",
"v5.0.3",
"v4.1.20",
"v4.4.10",
"v4.5.6",
"v5.0.2",
"v4.5.5",
"v5.0.1",
"v4.1.19",
"v4.4.9",
"v4.1.18",
"v5.0.0",
"v4.5.4",
"v4.4.8",
"v4.5.3",
"v4.4.7",
"v4.1.17",
"v4.5.2",
"v4.4.6",
"v4.1.16",
"v4.5.1",
"v4.4.5",
"v4.1.15",
"v4.5.0",
"v4.4.4",
"v4.1.14",
"v4.1.13",
"v4.4.3",
"v4.4.2",
"v4.1.12",
"v4.4.1",
"v4.1.11",
"v4.1.10",
"v4.4.0",
"v4.1.9",
"v4.1.8",
"v4.1.7",
"v4.1.6",
"v4.1.5",
"v4.1.4",
"v4.1.3",
"v4.1.2",
"v4.1.1",
"v4.1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-67857.json"
}
}
],
"modified": "2026-10-28T02:30:38.021165891Z",
"provider": "osv",
"references": [
"https://github.com/moodle/moodle/",
"https://moodle.org/mod/forum/discuss.php?d=471307",
"https://access.redhat.com/security/cve/CVE-2025-67857",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67857.json",
"https://nvd.nist.gov/vuln/detail/CVE-2025-67857",
"https://bugzilla.redhat.com/show_bug.cgi?id=2423868"
],
"provider_metadata": {
"cwe_ids": [
"CWE-201"
],
"cna_assigner": "fedora",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67857.json"
}
},
"related_cves": [
{
"value": "CVE-2025-67857",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 505431,
"published_at": "2026-02-03T10:52:22.459+00:00"
}