Security announcements | Moodle.org

Additional checks were required to ensure users can only fetch cohort data they are intended to have access to.

Insufficient capability checks in a messaging web service made it possible to view other users' names and online status.

Additional checks were required to prevent users deleting course sections they did not have permission to modify.

The return URL in the policy tool required extra sanitizing to prevent a reflected XSS risk.

A remote code execution risk was identified in the Moodle LMS EQUELLA repository. By default this was only available to teachers and managers, on sites with the EQUELLA repository enabled.

A remote code execution risk was identified in the Moodle LMS Dropbox repository. By default this was only available to teachers and managers, on sites with the Dropbox repository enabled.

Insufficient capability checks made it possible for a user enrolled in a course to access some details (full name and profile image URL) of other users they did not have permission to access.

The analysis request action in the Brickfield tool did not include the necessary token to prevent a CSRF risk.

A user's CSRF token was unnecessarily included in the URL on the database module's edit and delete pages.

Insufficient capability checks made it possible to view RSS feed content a user does not have permission to access.