Description
A flaw was found in moodle. During anonymous assignment submissions, user identifiers were inadvertently exposed in URLs. This data exposure allows unauthorized viewers to see internal user IDs, compromising the intended anonymity and potentially leading to information disclosure.
Scores
CVSS v3
4.3
EPSS
0.0002
EPSS Percentile
4.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-201
Status
published
Products (3)
moodle/moodle
5.1.0
moodle/moodle
< 4.1.21
moodle/moodle
0 - 4.1.22Packagist
Published
Feb 03, 2026
Tracked Since
Feb 18, 2026