CVE-2025-67856: Moodle Badge Award Authorization Flaw

CVE-2025-67856 is a medium severity flaw (CVSS 5.4) in Moodle. Incomplete role checks during badge awarding let users grant badges they should not be able to. The record gives no affected or fixed versions, so check Moodle's release notes and the Red Hat entry.

What's affected

• Moodle, with the flaw in the badge awarding process.
• Affected and fixed versions: not stated in the record. Check the Moodle security announcements for your branch.
• The record scores it 5.4 and requires a logged in user.

How to check if you're exposed

Read your Moodle version under Site administration, then Notifications, or on the admin page. Compare it with the latest security release on your supported branch.

You can also review who holds roles that can award badges, and review recent badge awards for anything unexpected. Badge records show who awarded each one.

What to do now

1. Confirm your Moodle version and supported branch.
2. Read the Red Hat CVE entry and the Moodle release notes for the fixed version.
3. Upgrade to the latest minor release for your branch.
4. Review role assignments that allow badge awarding.
5. Audit recent badge awards for unexplained entries.

Moodle sites usually have many roles and custom permissions built up over years. A flaw in a role check is a good reason to review them. Look for custom roles that include badge awarding rights, and check that they are assigned only to people who need them, at the narrowest context level.

Why it matters

The weakness is CWE-863, incorrect authorization. The system checks that a user is logged in, but the check for what role they hold is incomplete at the moment a badge is granted.

The impact is limited by the score, but badges can unlock content or certify completion, so a wrong award can matter for access and for records. The record does not list this CVE as exploited in the wild.

Quick check

Sources

• https://access.redhat.com/security/cve/CVE-2025-67856

Last reviewed: 19 October 2026.