-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | < 2.5.9 | 2.5.9 |
| moodle/moodle | composer | >= 2.6.0, < 2.6.6 | 2.6.6 |
| moodle/moodle | composer | >= 2.7.0, < 2.7.3 | 2.7.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper access control in mod/lti/launch.php. The original code used require_login($course), which validated course-level access but did not check activity-level permissions via the module context. The patch introduced context_module::instance and require_capability('mod/lti:view'), enforcing activity-level checks. The absence of these checks in the vulnerable versions made the require_login($course) call the critical weak point, as it failed to restrict access to the specific LTI activity.