CVE-2022-0985: Moodle

Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days.

Insufficient capability checks could allow users with the moodle/site:uploadusers capability to delete users, without having the necessary moodle/user:delete capability.

Affected products

• Moodle Moodle: before 3.9.13 (fixed in 3.9.13); from 3.10.0, before 3.10.10 (fixed in 3.10.10); from 3.11.0, before 3.11.6 (fixed in 3.11.6)

Published 2022-04-29. Last modified 2026-06-17.