CVE-2014-0215: The blind-marking implementation in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6...

Security readout for executives and security teams

This Moodle issue could let a logged-in user reveal student identities that blind marking was meant to hide. The business impact is mainly privacy, grading integrity, and trust in assessment processes, not system takeover. Exposure is most likely in older Moodle deployments using assignment blind marking. The attacker must be authenticated, and the source bundle does not identify unauthenticated access or broader code execution. Prioritize remediation where Moodle supports formal assessment, regulated education records, or high-stakes grading. This is not presented as a takeover flaw, but it can undermine anonymity commitments and expose student information. Mitigation focus: Inventory Moodle versions and flag 2.3.11 or older, 2.4<2.4.10, 2.5<2.5.6, or 2.6<2.6.3.; Upgrade affected Moodle 2.4, 2.5, and 2.6 sites to at least the fixed versions named in the CVE.; For Moodle 2.3.x, check Moodle vendor guidance; the source bundle does not name a fixed 2.3 release..

Prepared

Jun 14, 2026, 14:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.