CVE-2025-26527: medium-severity vulnerability in moodle
Non-searchable tags can still be discovered on the tag search page and in the tags block
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Users can discover tags that should be hidden from them by using the tag search page or viewing the tags block. This undermines access controls and may expose sensitive tag information.
A broken access control vulnerability allows authenticated users to enumerate non-searchable tags through the tag search endpoint or tags UI component without proper visibility filters. The vulnerability exists due to insufficient authorization checks on tag discovery mechanisms, potentially exposing sensitive categorization metadata.
In the same product, most dangerous first.