---
id: CVE-2025-60511
title: >-
  Moodle OpenAI Chat Block plugin 3.0.1 (2025021700) suffers from an Insecure
  Direct Object Reference (IDOR) vulnerability due to insufficient validation of
  the blockId parameter in /blocks/openai_chat/api/completion.php
summary: >-
  Moodle OpenAI Chat Block plugin 3.0.1 (2025021700) suffers from an Insecure
  Direct Object Reference (IDOR) vulnerability due to insufficient validation of
  the blockId parameter in /blocks/openai_chat/api/completion.php. An
  authenticated …
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-639
published: '2025-10-21'
updated: '2026-07-05'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-60511'
references:
  - url: 'https://github.com/onurcangnc/moodle_block_openai_chat'
    label: cve@mitre.org
  - url: >-
      https://onurcangenc.com.tr/posts/idor-in-moodle-openai-chat-block-block_openai_chat-proof-of-concept-poc--cve-2025-60511/
    label: cve@mitre.org
tags:
  - nvd
epss: 0.00216
epssPercentile: 0.10702
ingestedAt: '2026-07-06T16:44:34.305Z'
---

## Overview

Moodle OpenAI Chat Block plugin 3.0.1 (2025021700) suffers from an Insecure Direct Object Reference (IDOR) vulnerability due to insufficient validation of the blockId parameter in /blocks/openai_chat/api/completion.php. An authenticated student can impersonate another user's block (e.g., administrator) and send queries that are executed with that block's configuration. This can expose administrator-only Source of Truth entries, alter model behavior, and potentially misuse API resources.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.