CVE-2014-0009: Moodle

Medium severity, CVSS 5.5. EPSS: 1.2% chance of exploitation in the next 30 days.

course/loginas.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 does not enforce the moodle/site:accessallgroups capability requirement for outside-group users in a SEPARATEGROUPS configuration, which allows remote authenticated users to perform "login as" actions via a direct request.

Affected products

• Moodle Moodle: version 2.6.0 only; up to and including 2.2.11; version 2.0.0 only; version 2.0.1 only; version 2.0.2 only; version 2.0.3 only; …

Published 2014-01-20. Last modified 2026-06-17.