CVE-2025-49515: Details of hidden courses visible in Moodle

In Moodle, hidden courses are only visible to accounts with the moodle/course:viewhiddencourses capability, usually teachers and managers. Universities and companies use this to prepare courses before opening them.

Expanding an entry in the course category listing loads further details in the background. That request fetched the course straight from the database and returned it without asking about visibility or the matching capability.

Reported by Vincent Schneider through the Moodle security process, published as MSA-25-0033.

Any account that can open the course listing but may not see hidden courses was affected, typically students. No special permission was needed; asking for the identifier of a hidden course was enough.

What leaked was the name and description of a hidden course along with its assigned teachers. Course content and participant lists stayed protected.

It becomes awkward when the course name alone gives away something not yet announced, such as a planned degree programme.

Moodle now checks whether the course is hidden before returning anything and, if it is, requires moodle/course:viewhiddencourses. Without that capability the page answers as if the course did not exist.