CVE-2025-49516: CSRF in badge backpack management in Moodle
Site administration lets you change the order of the configured badge backpacks with arrow links. Those links checked no token and could therefore be called from a third-party web page.
1Summary
- Advisory
- MSA-25-0034
- System
- Moodle
- Component
- Badges, external backpack management (core_badges)
- Class
- Cross-site request forgery (CSRF)
- Severity
- Minor
Backpacks let users send the badges they earned in Moodle to external services. Which services are offered, and in which order, is set in a list in site administration.
The "move up" and "move down" links in that list carried no sesskey. When another website called them in a permitted user's browser, Moodle moved the entry as if that user had clicked.
Reported by Vincent Schneider through the Moodle security process, published as MSA-25-0034.
2Who is affected
Logged-in users allowed to manage the site's backpacks.
This only has an effect in the browser of someone who is logged in and allowed to edit the backpack list.
3Impact
The only consequence is a different order of the backpacks in that list.
4Fix
- Affected versions
- 5.0.0, 4.5.0 to 4.5.4, 4.4.0 to 4.4.8, 4.1.18 and earlier
- Fixed in
- 5.0.1, 4.5.5, 4.4.9, 4.1.19
- Published
- 17 Jun 2025
- Fix in the source
- 4efea4e
Both links now include the token. The page only moves an entry after confirm_sesskey() has accepted it.
We check for this class of flaw in every project we build or audit. For third-party code as a security audit.
5 / Contact
Should we review your Moodle plugins?
Describe your project in three short steps. We usually reply within one business day.