-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stemmed from an incorrect capability check in user/index.php. The commit diff shows the removal of 'has_capability('moodle/course:viewhiddenuserfields', $context)' from the conditional that controls email display. This check erroneously allowed users with the 'teacher' role (who had this capability) to view student emails. The patch removed this check, confirming it was the root cause of the authorization flaw.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | < 2.7.13 | 2.7.13 |
| moodle/moodle | composer | >= 2.8.0, < 2.8.11 | 2.8.11 |
| moodle/moodle | composer | >= 2.9.0, < 2.9.5 | 2.9.5 |
| moodle/moodle | composer | >= 3.0.0, < 3.0.3 | 3.0.3 |
Ongoing coverage of React2Shell