Moodle: moodle: brute-force facilitation due to missing rate limiting in confirmation email service

Vulnerability

Overview

CVE-2025-67853 describes a missing rate-limiting control in Moodle's confirmation email service. The endpoint responsible for sending confirmation emails does not enforce any throttling mechanism, allowing an attacker to submit repeated requests without restriction. This flaw stems from a design oversight where the service fails to limit the frequency of email confirmation requests, as noted in the Red Hat advisory [1] and the NVD entry [2].

Exploitation

Prerequisites

An attacker can exploit this vulnerability remotely without requiring prior authentication. By sending a high volume of confirmation email requests for known or guessed email addresses, the attacker can observe differences in server responses (e.g., timing, error messages) to determine whether an account exists. This enumeration technique reduces the search space for subsequent brute-force password attacks. The Bugzilla report [4] confirms that the endpoint provides less resistance to credential guessing.

Impact

Successful exploitation allows an attacker to enumerate valid user accounts on the Moodle instance. With a list of valid usernames or email addresses, the attacker can then launch targeted brute-force attacks against those accounts, potentially gaining unauthorized access. The impact is heightened in environments where weak passwords are common or where multi-factor authentication is not enforced.

Mitigation

Status

As of the publication date (2026-02-03), no patch has been announced. Administrators are advised to implement additional rate-limiting controls at the web server or application firewall level, or to monitor for unusual spikes in confirmation email requests. The Moodle project may address this in a future release; users should track the official Moodle security announcements.