Security announcements | Moodle.org

When blind marking is enabled for an assignment, user IDs remained visible on the assignment submissions page instead of being masked.

Badges being awarded with a role performed the correct capability check, but did not verify the user had the required role to meet the award criterion.

The return URL in the policy tool required extra sanitizing to prevent a reflected XSS risk.

Forum ratings required additional permission checks to prevent users from being able to view ratings they did not have the capability to access.

Insufficient checks on a confirmation email web service made it easier to brute force password checks against known usernames.

An open redirect risk existed in the OAuth login functionality.

Insufficient sanitizing when exporting data to CSV / XLSX format could result in malicious formulas being inserted into the files.

Note: Most modern spreadsheet software will warn users and require confirmation before running potentially risky formulas, however this is still considered a risk as users may still accept the warning.

Insufficient sanitizing in the formula editor could result in an XSS risk.

Insufficient sanitizing of AI provider responses resulted in an XSS risk.

Suspended users were not prevented from authenticating via the LTI Provider