HeroDevs
Visit NES for Moodle Home Page

Moodle 4.3.x Release Notes

2 versions

Comprehensive release notes and changelog for Moodle 4.3.x, including security patches, bug fixes, and feature updates across all supported versions.

Oct 12, 2026
Latest: 4.3.14
49 Patched Vulnerabilities
VEX Statements

October 2026

4.3.14

Released Oct 12, 2026
Full Version: 
4.3.14+4.3.12:moodle

Notes

  • Backports 11 advisories published since NES for Moodle 4.3.13 that apply to the 4.3 line. None has a CVE assigned by Moodle at the time of release; this page is updated as identifiers are published.
  • CVEs are now assigned to the 18 advisories in 4.3.13 that had none at its release, and those entries below are updated.
  • $branch remains 403 and $maturity remains MATURITY_STABLE, so Moodle 4.3 compatibility is unchanged.

Full Version: 4.3.14+4.3.12:moodle

Install this release with the installation guide, including the database update. Moodle does not record the new $version until the update runs.

Use these values to verify your installation. Build: 20261008 is the date this build was cut, not its release date.

CheckValue
Core $release4.3.14+4.3.12 (Build: 20261008)
Core $version2023100914.00

Security Fixes

Severity follows Moodle's own rating for each advisory, as published in the Moodle security advisories.

Serious
  • MSA-26-0042 - Blind SQL injection in profile availability condition (reject standard field names not in the allowlist). CVE not yet assigned | MDL-89484
  • MSA-26-0041 - CSRF in XML grade imports. import.php now rejects direct access outside key login, and interactive imports run from the sesskey-protected form. CVE not yet assigned | MDL-84545
  • MSA-26-0032 - User profile information disclosure via grade web service (get_gradable_users now requires moodle/site:viewuseridentity instead of moodle/course:viewparticipants). CVE not yet assigned | MDL-89381
  • MSA-26-0031 - SQL injection in question bank web service (entryid is cleaned as an integer and bound as a query parameter). CVE not yet assigned | MDL-89383
  • MSA-26-0030 - SSRF in URL downloader via IPv4-mapped IPv6 addresses (address_in_subnet() also checks the unwrapped IPv4 form against the blocked-hosts list). CVE not yet assigned | MDL-88779
Minor
  • MSA-26-0043 - Login notification bypass via spoofed Moodle App user agent. The user-agent exemption is removed, and the notification is skipped only when the MOODLEID1_ cookie shows the same user logging in again. CVE not yet assigned | MDL-87817
    • Limitation: Moodle 4.3 still protects the MOODLEID1_ cookie with RC4. Upstream moved it to \core\encryption in 4.5 through MDL-81940, a non-security change that is not backported, so the same-user check is weaker than upstream's.
  • MSA-26-0040 - Report builder user filters and columns did not respect profile field visibility (visibility is now checked in the system context). CVE not yet assigned | MDL-87518
  • MSA-26-0039 - Minor XSS via password reset link (username escaped in the reset confirmation email and the password-set form). CVE not yet assigned | MDL-88335
  • MSA-26-0035 - Manual enrolment did not observe the plugin's disabled state (enrol/manual/manage.php now throws when enrol_manual is disabled). CVE not yet assigned | MDL-88593
  • MSA-26-0034 - XSS in forum post templates (the post subject is escaped into a label property instead of being interpolated into a string argument). CVE not yet assigned | MDL-88981
  • MSA-26-0033 - Arbitrary class instantiation via report builder audience classname (only audience base subclasses are accepted). CVE not yet assigned | MDL-89078

4.3.13

Released Oct 1, 2026
CVE-2026-58347
CVE-2026-58345
CVE-2026-58340
CVE-2026-58336
CVE-2026-58334
44 More
Full Version: 
4.3.13+4.3.12:moodle

Notes

  • Initial NES for Moodle release, forked from upstream Moodle 4.3.12 - the final upstream 4.3.x release.
  • Backports every Moodle security advisory published after Moodle 4.3.12 that applies to the 4.3 line: 49 advisories, covering 49 assigned CVEs.
  • Includes fixes for vulnerabilities in third-party libraries vendored into Moodle core (ADOdb, FPDI), patched in place.
  • $branch remains 403 and $maturity remains MATURITY_STABLE, so Moodle 4.3 compatibility is unchanged.

Full Version: 4.3.13+4.3.12:moodle

Install this release with the installation guide, including the database update. Moodle does not record the new $version until the update runs.

Use these values to verify your installation. Build: 20260618 is the date this build was cut, not its release date.

CheckValue
Core $release4.3.13+4.3.12 (Build: 20260618)
Core $version2023100913.00

Security Fixes

Severity follows Moodle's own rating for each advisory, as published in the Moodle security advisories.

Serious
  • MSA-26-0028 - DoS via overlong user profile description (length validation). CVE-2026-58347 | MDL-87898
  • MSA-26-0026 - Missing capability check in assignment marker allocation. CVE-2026-58345 | MDL-88529
  • MSA-26-0021 - CSRF and XSS in grade item idnumber editing. CVE-2026-58340 | MDL-88542
  • MSA-26-0017 - IDOR allows arbitrary comment deletion (strict load before delete). CVE-2026-58336 | MDL-88619
  • MSA-26-0015 - RCE via admin presets import (strengthen import/apply validation). CVE-2026-58334 | MDL-88735
  • MSA-26-0014 - Arbitrary file read in backup restore. File record data is now validated. CVE-2026-58333 | MDL-88736
  • MSA-26-0013 - Email-based MFA bypass (improve Email factor validation). CVE-2026-58332 | MDL-88767
  • MSA-26-0012 - Arbitrary file read in Database activity module (check zip content; clean CSV filenames). CVE-2026-58331 | MDL-88595
  • MSA-26-0006 - RCE via Google Drive repository plugin (prepared file path must be a name only). CVE-2026-7275 | MDL-88423
  • MSA-26-0005 - SQL injection in external database authentication (auth_db). String interpolation is replaced with parameterized queries across the login, user lookup, user existence, and user update paths. CVE-2026-7274 | MDL-88138
  • MSA-26-0003 - DoS in TeX formula editor (mimetex timeout handling). CVE-2026-26047 | MDL-86785
  • MSA-26-0002 - Remote code execution via the TeX filter admin setting. The background argument in filter/tex/latex.php is escaped and the setting is moved to the colour picker. Colour-picker validation is now anchored, so a value is no longer accepted merely for containing a colour - this hardens every colour-picker setting, not only the TeX one. CVE-2026-26046 | MDL-87870 | MDL-87843
  • MSA-26-0001 - RCE via file restore (safer unserializing of repository file source data). CVE-2026-26045 | MDL-87612
  • MSA-25-0059 - Reflected XSS in the policy tool via PARAM_LOCALURL. The javascript: pattern in clean_param() is strengthened. CVE-2025-67855 | MDL-86544
    • Behaviour change: the new pattern matches javascript as a whole word anywhere before a : or /, so a relative local URL that merely contains the word is now cleaned to an empty string - for example docs/javascript/index.html. Root-relative and wwwroot-absolute URLs return before the check and are unaffected, and matching is whole-word only, so docs/javascripts/index.html still passes. Sites that route such relative paths through PARAM_LOCALURL must make them root-relative or use a different param type. This is upstream's own trade-off, not a porting artefact.
  • MSA-25-0055 - Formula injection when exporting to CSV/Excel/ODS (escape leading =,+,-,@ and control chars in dataformat and grade exports). CVE-2025-67851 | MDL-72744
  • MSA-25-0054 - XSS in the formula (equation) editor preview. Input is sanitised in both atto_equation and tiny_equation. CVE-2025-67850 | MDL-85557
  • MSA-25-0052 - Authentication via LTI Provider available to suspended users (block suspended accounts in legacy LTI and LTI 1.3 auth). CVE-2025-67848 | MDL-87286
  • MSA-25-0051 - Remote code execution via file restore. Stored-file source data is now read with the safe unserialize_object() helper instead of raw @unserialize(), preventing PHP object injection during draft-file save and restore. CVE-2025-67847 | MDL-87353
  • MSA-25-0047 - MFA bypass via mfa_pending NO_REDIRECT path. CVE-2025-62398 | MDL-86334
  • MSA-25-0042 - Exception handling in bundled FPDI PDF library. CVE-2025-54869 | MDL-86353
  • MSA-25-0035 - Missing authorisation checks in BigBlueButton view page. CVE-2025-49517 | MDL-84706
  • MSA-25-0033 - Course visibility not honoured consistently. CVE-2025-49515 | MDL-84518
  • MSA-25-0032 - SSRF via DNS rebind (bind resolved IPs/ports for cURL). CVE-2025-49514 | MDL-83762
  • MSA-25-0031 - SQL escaping in the bundled ADOdb PostgreSQL driver. CVE-2025-46337 | MDL-85375
Minor
  • MSA-26-0029 - Report builder fragment callbacks missing access checks (verify can-view/can-edit and audience add permission in filters/audience form fragments). CVE-2026-58348 | MDL-84535
  • MSA-26-0027 - Blind SSRF in MNet peers function (validate peer hostname). CVE-2026-58346 | MDL-87911
  • MSA-26-0023 - CSRF when adding quiz section headings (sesskey protection). CVE-2026-58342 | MDL-88540
  • MSA-26-0022 - CSRF in group messaging state toggle (require_sesskey on enable/disablemessaging; sesskey field in groups index template). CVE-2026-58341 | MDL-88541
  • MSA-26-0020 - Reflected XSS via Feedback import error message (stricter cleaning). CVE-2026-58339 | MDL-88543
  • MSA-26-0019 - CSRF in user profile page reset (sesskey check). CVE-2026-58338 | MDL-88545
  • MSA-26-0018 - CSRF in user homepage preference setting (sesskey check on setdefaulthome in index.php and my/index.php). CVE-2026-58337 | MDL-88609
  • MSA-26-0016 - Missing group-mode access checks in grade web services. CVE-2026-58335 | MDL-88667
  • MSA-26-0011 - CSRF and missing capability check in admin/mnet/peers.php. CVE-2026-7278 | MDL-84495
  • MSA-26-0007 - Messaging DoS from messages of deleted users (validation). CVE-2026-7276 | MDL-87760
  • MSA-25-0061 - User IDs exposed in URLs with anonymous assignment submissions (use blind id instead of userid in grading table and submission removal). CVE-2025-67857 | MDL-82808
  • MSA-25-0060 - Badges with role criterion awarded to users without the role. CVE-2025-67856 | MDL-86507
  • MSA-25-0058 - Participants can access ratings without permission. View and view-all rating permissions are now enforced in Forum, Database, and Glossary. CVE-2025-67854 | MDL-86960
  • MSA-25-0057 - Password brute force via confirmation-email web service (validation). CVE-2025-67853 | MDL-86326
  • MSA-25-0056 - Open redirect in OAuth2 login (restrict redirect to local URLs). CVE-2025-67852 | MDL-80317
  • MSA-25-0050 - Bypass timer in timed assignments (respect timer server-side in submission flow). CVE-2025-62401 | MDL-75087
  • MSA-25-0049 - Hidden group names visible via group calendar events (event form shows only accessible groups). CVE-2025-62400 | MDL-86261
  • MSA-25-0048 - Password brute force via web service auth (stricter login check). CVE-2025-62399 | MDL-86327
  • MSA-25-0044 - External cohort search web service leaks system cohort data. CVE-2025-62395 | MDL-85421
  • MSA-25-0040 - Profile-access callbacks not enforced in web services (user_get_user_details now runs control_view_profile callbacks; new user_process_profile_callbacks). CVE-2025-62438 | MDL-63395
  • MSA-25-0039 - Feedback results ignored Separate Groups mode (new mod_feedback manager::can_see_others_in_groups gate on entries/non-respondents). CVE-2025-62437 | MDL-84463
  • MSA-25-0038 - Course Logs / Live Logs reports ignored Separate Groups mode (hide report for teachers without groups; new report_helper::has_valid_group). CVE-2025-62436 | MDL-84464
  • MSA-25-0036 - IDOR: fetch other users' recently accessed courses via web service (require moodle/user:viewalldetails). CVE-2025-49518 | MDL-79993
  • MSA-25-0034 - CSRF in badges backpack management (add sesskey checks). CVE-2025-49516 | MDL-84497
  • MSA-25-0030 - Password revealed on login page after logout (login-page caching). CVE-2025-49513 | MDL-85323

Stay in the loop

~/herodevs-spring-framework-support

Open Source Support

When official support ends, we're just getting started.