CVE-2025-67856: 
PHP vulnerability analysis and mitigation

CVE-2025-67856 is an authorization logic flaw in Moodle's badge awarding process, caused by incomplete role checks that allow badges to be granted without proper verification. This could enable unauthorized users to obtain badges they are not entitled to, potentially leading to privilege escalation or unauthorized access to certain features. Affected versions include Moodle < 4.1.22, 4.4.0–4.4.12, 4.5.0–4.5.8, 5.0.0–5.0.4, and 5.1.0–5.1.1. The vulnerability was reported on December 19, 2025, and publicly disclosed on February 3, 2026. The GitHub Advisory Database rates it as Moderate with a CVSS v3.1 score of 5.4, while Feedly's NVD data assigns a higher score of 9.8 (Critical) — the more conservative 5.4 score (requiring low privileges) is reflected in the GitHub advisory (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-863 (Incorrect Authorization): the badge awarding process in Moodle does not fully verify a user's role before granting a badge, allowing the authorization check to be bypassed (Github Advisory). An attacker with at least low-level authenticated access can exploit this flaw by interacting with the badge awarding functionality over the network without requiring user interaction. The fix is visible in the Moodle source repository commit moodle/moodle@0d48779, which addresses the incomplete role verification logic (Github Advisory). No public proof-of-concept exploit code has been identified at this time (Github Advisory).

Successful exploitation allows unauthorized users to grant themselves badges they have not legitimately earned, which can lead to privilege escalation and unauthorized access to features or content restricted to badge holders within a Moodle instance (Github Advisory, Red Hat Bugzilla). The confidentiality and integrity of the badge system are directly affected, as unearned credentials could be used to access restricted course materials or administrative features. Availability is not directly impacted by this vulnerability.

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept at this time (Github Advisory). The EPSS score is approximately 0.022% (6th percentile), indicating a low near-term probability of exploitation (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify Moodle instances running vulnerable versions (< 4.1.22, 4.4.0–4.4.12, 4.5.0–4.5.8, 5.0.0–5.0.4, or 5.1.0–5.1.1) using version disclosure on login pages or Shodan/Censys searches for Moodle deployments.
2. Authentication: Obtain or register a low-privilege user account on the target Moodle instance, as the vulnerability requires at minimum a low level of authenticated access.
3. Trigger badge awarding: Interact with the badge awarding functionality (e.g., via crafted HTTP requests to the badge award endpoint) in a way that bypasses the incomplete role checks, causing the system to grant a badge without proper authorization verification.
4. Privilege escalation: Use the improperly awarded badge to access features, course content, or administrative functions that are restricted to users holding that badge, effectively escalating privileges within the Moodle platform (Github Advisory, Red Hat Bugzilla).

• Logs: Moodle event logs showing badge award events (\core\event\badge_awarded) for users who did not complete the required criteria or were not awarded by an authorized instructor.
• Logs: Unexpected or anomalous badge award entries in the Moodle database (mdl_badge_issued table) for users lacking the prerequisite course completions or manual awards.
• Application Behavior: Users accessing course content or features restricted to badge holders without a legitimate record of earning those badges.
• Network: Unusual or repeated HTTP requests to Moodle badge-related endpoints (e.g., /badges/award.php) from low-privilege user accounts.

Moodle has released patched versions addressing this vulnerability. Administrators should upgrade to the following fixed versions as soon as possible: 4.1.22 (for 4.1.x), 4.4.12 (for 4.4.x), 4.5.8 (for 4.5.x), 5.0.4 (for 5.0.x), or 5.1.1 (for 5.1.x) (Github Advisory). As an interim workaround prior to patching, administrators should restrict badge awarding permissions to trusted roles only and review badge award logs for any unauthorized grants. Monitoring the mdl_badge_issued table for anomalous entries is also recommended until the patch is applied.

Red Hat tracked this vulnerability via their Bugzilla system (Bug 2423864) and assigned it a medium severity rating, reflecting the requirement for some level of authenticated access (Red Hat Bugzilla). The GitHub Advisory Database published the advisory on February 3, 2026, rating it as Moderate severity. No significant broader media coverage or notable researcher commentary beyond standard vulnerability database entries has been identified.