Moodle Badge Management Vulnerability Allowing Unauthorized Badge Disabling

A vulnerability exists in Moodle's badge management system, specifically in versions 4.1 prior to 4.1.16, 4.3 prior to 4.3.10, 4.4 prior to 4.4.6, and 4.5 prior to 4.5.2. The issue arises from inadequate capability checks, which enable users to disable badges they do not have permission to access. This improper handling creates an Insecure Direct Object Reference (IDOR) vulnerability, allowing for the arbitrary manipulation of badge statuses.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in badge assignments, allowing users to disable badges incorrectly.

Remediation

Users can upgrade to Moodle versions 4.1.16, 4.3.10, 4.4.6, or 4.5.2 to address this vulnerability.