Security announcements | Moodle.org

In a database activity with separate groups mode enabled, users who were not in a group (and did not have permission to access all groups) could see entries from members of all groups in the activity, rather than just entries of users also not in any groups. Note: Users within groups worked as intended, only able to see entries belonging to other members of their group(s).

On sites requiring a confirmation step to update a user's email address, the token used to verify the change should only be accessible via the confirmation email, but was otherwise retrievable by the user.

Insufficient checks meant users could see users tagged with a tag, regardless of whether they had access to view the users' profiles.

Insufficient capability checks in a learning plan web service could result in users having the ability to retrieve information they did not have permission to access (such as users' names).

Additional checks were required to ensure users can only access the schedule of a report if they have permission to edit that report.

Additional checks were required to ensure users with permission to view badge recipients can only access lists of those they are intended to have access to.

Additional checks were required to ensure users can only fetch the list of course badges for courses they are intended to have access to.

Users with access to delete audiences from some reports could delete audiences from other reports they did not have permission to delete from.

Additional checks were required to ensure users can only edit or delete RSS feeds they have permission to modify.

It was possible for users with the "send message" capability to view other users' names they may not otherwise have access to, via an error message in Messaging. (Note: The name returned followed the full name format configured on the site).