CVE-2014-0009: course/loginas.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, a...

Security readout for executives and security teams

Some older Moodle sites let an authenticated user bypass group separation and use “login as” behavior by sending a direct request. This matters where courses rely on separate groups for privacy or operational boundaries. The sources do not show public exploitation or a CVSS score. Exposure is limited to older Moodle versions: through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, especially courses using Separate groups. Treat as a targeted access-control issue for legacy Moodle environments. Prioritize if Moodle stores sensitive learner, staff, or assessment data and relies on group separation. Current urgency is lower without KEV or active exploitation evidence. Mitigation focus: Upgrade Moodle to a fixed version named by the advisory path.; For 2.2.x deployments, consult Moodle guidance because the bundle only lists affected versions.; Restrict login-as privileges to trusted administrative roles..

Prepared

Jun 14, 2026, 14:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.