CVE-2025-3628 is a vulnerability identified in Moodle version 4.5.0, a widely used open-source learning management system (LMS). The flaw allows unauthorized actors to de-anonymize assignment submissions that were intended to be anonymous. Specifically, the vulnerability arises from a weakness in the search functionality within Moodle, which inadvertently exposes student identities linked to their anonymous submissions. This exposure violates the confidentiality of student data, undermining the privacy guarantees typically provided by anonymous assignment features. The vulnerability does not require authentication or elevated privileges to exploit, as it leverages the search mechanism accessible to unauthorized users. Although no known exploits are currently active in the wild, the potential for sensitive information leakage is significant, especially in academic environments where anonymity is critical for unbiased grading and privacy. The flaw affects only Moodle version 4.5.0, and no patches or official vendor mitigations have been published at the time of this analysis. The issue was reserved and publicly disclosed in April 2025, with enrichment from CISA indicating recognition of its security relevance.

For European organizations, particularly educational institutions and universities that rely heavily on Moodle for course management and assessments, this vulnerability poses a direct threat to student privacy and data protection compliance. The unauthorized exposure of student identities linked to their submissions could lead to breaches of GDPR regulations, resulting in legal and financial repercussions. Furthermore, the loss of anonymity may undermine the integrity of academic assessments, potentially affecting student trust and institutional reputation. The impact extends to any European organization using Moodle 4.5.0 for training or certification programs where anonymity is required. Since the vulnerability exposes personally identifiable information (PII) without requiring authentication, the risk of mass data leakage is elevated. The absence of known exploits in the wild currently limits immediate widespread damage, but the vulnerability remains a critical privacy concern that could be exploited by malicious actors targeting educational data or conducting surveillance on student activities.

Given the lack of an official patch, European organizations should implement immediate compensating controls. First, restrict or disable the search functionality related to assignment submissions for unauthenticated or low-privilege users to prevent unauthorized access to sensitive data. Administrators should audit and review Moodle user permissions to ensure that only trusted users have access to assignment search features. Additionally, organizations should consider temporarily disabling anonymous submission features until a patch is available or upgrading to a Moodle version that addresses this vulnerability once released. Monitoring Moodle logs for unusual search activity can help detect potential exploitation attempts. It is also advisable to communicate transparently with students about the issue and reinforce data privacy policies. Finally, organizations should maintain close contact with Moodle security advisories and apply patches promptly when they become available.