CVE-2025-3640: 
PHP vulnerability analysis and mitigation

A security vulnerability (CVE-2025-3640) was discovered in Moodle's capability checking system, disclosed on April 25, 2025. The vulnerability affects Moodle's user access control mechanism, specifically impacting the web service functionality. The flaw allows users enrolled in a course to access unauthorized user details, such as full names and profile image URLs of other users they should not have permission to view (NVD, Wiz).

The vulnerability is classified as an Insecure Direct Object Reference (IDOR) issue in Moodle's web service, stemming from insufficient capability checks in the user access control system. The CVSS v3.1 base score is 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The vulnerability is categorized under CWE-639 (Authorization Bypass Through User-Controlled Key) (NVD, Wiz).

The vulnerability enables enrolled course users to access unauthorized user information, specifically full names and profile image URLs of other users within the system. This represents a privacy breach as it exposes personal information to users who should not have access to it (Red Hat Bugzilla).