CVE-2017-12157: In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't a...

Security readout for executives and security teams

This Moodle 3.x issue is an access-control/privacy problem. Teachers could see details about users in groups they were not allowed to access through various course reports. The sources do not provide CVSS, exploit details, or a named fixed version, so urgency depends on whether affected Moodle 3.x systems still exist. Exposure is likely limited to Moodle 3.x deployments where teachers can access course reports and courses use group restrictions. It is most relevant to education platforms retaining older Moodle versions or custom forks based on Moodle 3.x. Treat this as a privacy and compliance exposure, not a confirmed remote takeover risk. Prioritize if Moodle 3.x still handles student, staff, or customer learning data, especially where group separation is used for confidentiality. Mitigation focus: Inventory Moodle 3.x instances, including hosted, archived, and forked deployments.; Review Moodle vendor guidance for the relevant fixed versions or security release notes.; Restrict teacher access to sensitive reports until patched or confirmed unaffected..

Prepared

Jun 12, 2026, 20:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.