CVE-2022-0333: Moodle

Low severity, CVSS 3.8. EPSS: 0.6% chance of exploitation in the next 30 days.

A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The calendar:manageentries capability allowed managers to access or modify any calendar event, but should have been restricted from accessing user level events.

Affected products

• Moodle Moodle: up to and including 3.8.9; from 3.9.0, before 3.9.12 (fixed in 3.9.12); from 3.10.0, before 3.10.9 (fixed in 3.10.9); from 3.11.0, before 3.11.5 (fixed in 3.11.5)

Published 2022-01-25. Last modified 2026-06-17.