A vulnerability in the Moodle Learning Tools Interoperability (LTI) authentication handler allows suspended users to bypass restrictions and access the system, posing a significant risk to data integrity.

This is an authentication bypass vulnerability (CWE-280) triggered by the LTI authentication handler failing to verify a user's suspension status. While the CVSS vector indicates low privileges are required, the impact allows a previously restricted user to regain unauthorized access to the application.

Successful exploitation allows suspended or restricted users to perform actions within the Moodle environment, leading to unauthorized information disclosure or administrative manipulation. With a CVSS score of 8.1, the vulnerability is classified as High severity because it undermines core access control policies, potentially leading to significant data exposure or misuse of institutional assets.

Immediate Action: Update your Moodle installation to the latest patched version: 4.1.22, 4.4.12, 4.5.8, or 5.0.4, depending on your current branch.

Proactive Monitoring: Monitor authentication logs specifically for login activity originating from accounts that have been explicitly marked as suspended in the user database.

Compensating Controls: If immediate patching is not feasible, consider temporarily disabling the LTI Provider feature if it is not business-critical to prevent exploitation of this vector.

Public Exploit Available: No

This vulnerability presents a high risk to organizations that rely on suspension status to enforce security and compliance policies. Administrators should prioritize the application of the vendor-provided patches listed above to ensure that access control logic is correctly enforced. Failure to remediate this issue may result in unauthorized access by users who should no longer have system privileges.