CVE-2020-14321: Moodle Incorrect Authorization vulnerability

August 17, 2022 (updated May 8, 2025)

In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign themselves the manager role within that course.

References

github.com/advisories/GHSA-9q29-jcjw-fw7h
github.com/moodle/moodle
github.com/moodle/moodle/commit/d07fb8b9e8bf47fe60ad2aea553329bd1fb96e37
moodle.org/mod/forum/discuss.php?d=407393
nvd.nist.gov/vuln/detail/CVE-2020-14321

Code Behaviors & Features

Detect and mitigate CVE-2020-14321 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →