Moodle: partial data exposure in moodle before completing multi-factor authentication

Vulnerability

CVE-2025-3627 is a security vulnerability in Moodle, the open-source learning platform. The root cause allows some authenticated users to access sensitive information about other students before those students have finished verifying their identities using two-factor authentication (2FA).

Exploitation

The vulnerability is exploitable by a user who is already authenticated and has some level of access to the platform. The attack surface involves the period during which another student is in the process of completing their 2FA verification. No additional privileges beyond that of a regular user are required. The flaw resides in how Moodle handles access to certain data during the 2FA verification process [1][2].

Impact

An attacker exploiting this flaw can obtain sensitive information about other students. The exact type of information is not detailed in the public sources, but it is characterized as sensitive, which could include personal or academic data. This breaks the confidentiality guarantees that 2FA is intended to protect.

Mitigation

As of the publication date, the vulnerability has been publicly disclosed, and a fix is expected to be available in a Moodle security release. Users are advised to update their Moodle installations once the patched version is released [3][4].