Moodle: IDOR in badges allows disabling of arbitrary badges (CVE-2025-26531)
A vulnerability in Moodle allows users to disable badges they should not have permission to access due to insufficient capability checks. This issue affects multiple Moodle versions and has been assigned CVE-2025-26531. A patch is available to address this issue.
AI Analysis
Technical Summary
CVE-2025-26531 is an Insecure Direct Object Reference (IDOR) vulnerability in Moodle's badge management system. The flaw arises from insufficient capability checks, enabling an attacker to disable arbitrary badges without proper authorization. This vulnerability affects Moodle versions 4.1.0 through 4.1.15, 4.3.0 through 4.3.9, 4.4.0 through 4.4.5, and 4.5.0 through 4.5.1. The issue has been fixed in later versions, and a patch is publicly available in the Moodle git repository under commit MDL-84239.
Potential Impact
An attacker with access to the badge management functionality can disable badges they are not authorized to manage. This could disrupt badge assignments and recognition within the Moodle platform but does not indicate direct compromise of user data or system control. No known exploits are reported in the wild.
Mitigation Recommendations
Apply the official patch provided by Moodle as referenced in the commit MDL-84239. Upgrading affected Moodle instances to versions 4.1.16 or later, 4.3.10 or later, 4.4.6 or later, and 4.5.2 or later will remediate this vulnerability.
Moodle: IDOR in badges allows disabling of arbitrary badges (CVE-2025-26531)
Description
A vulnerability in Moodle allows users to disable badges they should not have permission to access due to insufficient capability checks. This issue affects multiple Moodle versions and has been assigned CVE-2025-26531. A patch is available to address this issue.
Affected software
pkg:bitnami/moodleRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-26531 is an Insecure Direct Object Reference (IDOR) vulnerability in Moodle's badge management system. The flaw arises from insufficient capability checks, enabling an attacker to disable arbitrary badges without proper authorization. This vulnerability affects Moodle versions 4.1.0 through 4.1.15, 4.3.0 through 4.3.9, 4.4.0 through 4.4.5, and 4.5.0 through 4.5.1. The issue has been fixed in later versions, and a patch is publicly available in the Moodle git repository under commit MDL-84239.
Potential Impact
An attacker with access to the badge management functionality can disable badges they are not authorized to manage. This could disrupt badge assignments and recognition within the Moodle platform but does not indicate direct compromise of user data or system control. No known exploits are reported in the wild.
Mitigation Recommendations
Apply the official patch provided by Moodle as referenced in the commit MDL-84239. Upgrading affected Moodle instances to versions 4.1.16 or later, 4.3.10 or later, 4.4.6 or later, and 4.5.2 or later will remediate this vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-moodle-2025-26531
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2025-26531"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Medium
Patch Information
Threat ID: 6aa00610acd9273b49ab7386
Added to database: 09/08/2026, 12:56:48 UTC
Last enriched: 09/08/2026, 13:41:20 UTC
Last updated: 09/10/2026, 19:36:49 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.