CVE-2025-3636: Access to other users' RSS feeds in the Moodle RSS block
The page that shows a feed's content in the RSS block only asked for an ID. Who the feed belonged to made no difference to it.
1Summary
- Advisory
- MSA-25-0019
- System
- Moodle
- Component
- RSS block (block_rss_client)
- Class
- Insecure direct object reference (IDOR)
- Severity
- Minor
In the RSS block, anyone can add external feeds and decide whether others may use them too. To display a feed, Moodle loaded the record by its numeric ID alone.
Since those IDs are assigned in sequence, every stored feed was reachable that way, private ones included.
Reported by Vincent Schneider through the Moodle security process, published as MSA-25-0019.
2Who is affected
Any logged-in account except the guest account.
Before the fix the page only required a login, with the guest account excluded. Students could use it just as well as teachers, and no RSS block permission was needed.
3Impact
Whatever other users had subscribed to privately became readable, because Moodle fetches the stored address itself and shows the result. For a public news feed that is harmless.
If the feed address contains a personal access key and returns internal content, though, other accounts could read along. Data stored in Moodle itself was not exposed.
4Fix
- Affected versions
- 4.5.0 to 4.5.3, 4.4.0 to 4.4.7, 4.3.0 to 4.3.11, 4.1.17 and earlier
- Fixed in
- 4.5.4, 4.4.8, 4.3.12, 4.1.18
- Published
- 22 Apr 2025
- Fix in the source
- 0bd9720
The page now checks the permissions for managing own or shared feeds. It only loads a feed that belongs to the requesting user, or a shared one the user is permitted to see.
We check for this class of flaw in every project we build or audit. For third-party code as a security audit.
5 / Contact
Should we review your Moodle plugins?
Describe your project in three short steps. We usually reply within one business day.