A vulnerability was found in Moodle where users with "Log in as" capability in a course context (typically, course managers) may gain access to some site administration capabilities by "logging in as" a System manager. This affects 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and earlier unsupported versions. This is fixed in 3.9.2, 3.8.5, 3.7.8 and 3.5.14.

Affected Packages

Packagist moodle/moodle

Affected versions: 3.9 (fixed in 3.9.2)

Packagist moodle/moodle

Affected versions: 3.8 (fixed in 3.8.5)

Packagist moodle/moodle

Affected versions: 3.7 (fixed in 3.7.8)

Packagist moodle/moodle

Affected versions: 3.5 (fixed in 3.5.14)

Related CVEs

CVE-2020-25629

Key Information

GHSA ID

GHSA-f5r8-7h4f-jr9x

Published

May 24, 2022 5:35 PM

Last Modified

August 23, 2023 5:55 PM

CVSS Score

7.5 /10

Primary Ecosystem

Packagist

Primary Package

moodle/moodle

GitHub Reviewed

✓ Yes

Dataset

Last updated: July 31, 2025 6:36 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.