High
Security advisory
A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying the request to the LTI publisher site.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-3849
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 05:02 UTC · Revision 1
Source evidence
A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying the request to the LTI publisher site.
osv:CVE-2019-3849
Complete source record
{
"id": "ebbb97ec6b8d74e1a1425e08339acc5f9dc9080f9618bea6f04ad9e61fc83219",
"url": "https://osv.dev/vulnerability/CVE-2019-3849",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-3849",
"summary": "A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying the request to the LTI publisher site.",
"evidence": "osv:CVE-2019-3849",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2019-3849",
"aliases": [
"CVE-2019-3849",
"GHSA-5wg9-5w3f-hxmh"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/moodle/moodle",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "52bd62f2be983a1b8afb26b0f9bd08c60cbfd2e6"
},
{
"introduced": "46574904afd39578fa4146bf1fc5c401ac680aa6"
},
{
"fixed": "5e878219fbe7ab63d2a54ed02aff63443fb83192"
},
{
"introduced": "cb628a9a08933c2a9f1eae2f3be70ea5d343b419"
},
{
"fixed": "4d3a32dde97e964ad4512c35d15a1784c69c247e"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "3.4.8"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.5.0"
},
{
"fixed": "3.5.5"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.6.0"
},
{
"fixed": "3.6.3"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v3.5.4",
"v3.6.2",
"v3.4.7",
"v3.6.0",
"v3.6.1",
"v3.5.3",
"v3.4.6",
"v3.4.5",
"v3.5.2",
"v3.4.4",
"v3.5.1",
"v3.4.3",
"v3.5.0",
"v3.4.2",
"v3.4.1",
"v3.4.0",
"v3.4.0-rc2",
"v3.4.0-rc3",
"v3.4.0-rc1",
"v3.4.0-beta",
"v3.3.0",
"v3.3.0-rc3",
"v3.3.0-rc2",
"v3.3.0-rc1",
"v3.3.0-beta",
"v3.2.0-rc2",
"v3.2.0",
"v3.2.0-rc4",
"v3.2.0-beta",
"v3.2.0-rc5",
"v3.2.0-rc3",
"v3.2.0-rc1",
"v3.1.0-beta",
"v3.1.0",
"v3.1.0-rc2",
"v3.1.0-rc1",
"v3.0.0-rc3",
"v3.0.0",
"v3.0.0-rc4",
"v3.0.0-rc2",
"v3.0.0-rc1",
"v3.0.0-beta",
"v2.9.0",
"v2.9.0-rc2",
"v2.9.0-rc1",
"v2.9.0-beta",
"v2.8.0",
"v2.8.0-rc2",
"v2.8.0-rc1",
"v2.8.0-beta",
"v2.7.0",
"v2.7.0-rc2",
"v2.7.0-rc1",
"v2.7.0-beta",
"v2.6.0",
"v2.6.0-rc1",
"v2.6.0-beta",
"v2.5.0",
"v2.5.0-rc1",
"v2.5.0-beta",
"v2.4.0-beta",
"v2.4.0-rc1",
"v2.4.0",
"v2.3.0",
"v2.3.0-rc1",
"v2.3.0-beta",
"v2.2.0",
"v2.2.0-rc1",
"v2.2.0-beta",
"v2.1.0",
"v2.0.1",
"v2.0.0",
"v2.0.0-rc2",
"v2.0.0-rc1",
"v1.3.0",
"v1.2.1",
"v1.2.0",
"v1.1.1",
"v1.1.0",
"v1.0.9",
"v1.0.8",
"v1.0.7",
"v1.0.6",
"v1.0.5",
"v1.0.4",
"v1.0.3",
"v1.0.2",
"v1.0.1",
"v1.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-3849.json"
}
}
],
"modified": "2026-10-24T10:30:24.059593962Z",
"provider": "osv",
"references": [
"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3849",
"https://moodle.org/mod/forum/discuss.php?d=384012#p1547744"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2019-3849",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 431065,
"published_at": "2019-03-26T18:29:00.78+00:00"
}