-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from insufficient access control in the badge visibility toggle logic. The patch adds a 'userid' parameter to the database update conditions in badges/mybadges.php, explicitly tying the operation to the current user ($USER->id). The pre-patch code only used the badge ID ('id' => $hide/$show) in the WHERE clause, failing to validate() badge ownership. This allowed attackers to manipulate any badge's visibility by crafting requests with valid badge IDs. The direct correlation between the vulnerability description, patch diff, and CWE-264 (Permissions issue) confirms the root cause lies in these unconstrained set_field operations.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 2.5.0, < 2.5.5 | 2.5.5 |
| moodle/moodle | composer | >= 2.6.0, < 2.6.2 | 2.6.2 |