I added a custom field to Moodle, and selected that it should be "required" for all users in their profile. It is a dropdown list with 3 items.
As soon as I saved, Moodle sent me (the admin) to update my profile. Ok, so I choose one of the 3 options and click "update profile" (or cancel).
Immediately I get a 403 error.
I and everyone else am locked out of Moodle until I can fix. Been looking thru php files and Google but so far no luck.
I tried to reproduce the problem but it worked as expected. I have Moodle 3.8 and added a Drop-down menu profile field setting Is this field required? to "Yes" and adding three lines to Menu options (one per line). When I click Save changes I'm redirected to the Edit profile page for the user as you describe but on selecting a value for the new field and clicking Update profile the profile is saved as expected.
What is the authentication type for your users? Are they manual users or is their authentication integrated with an external service? I'm wondering if when the profile is being saved Moodle is configured to try to update an external service which is failing. You can check the auth column in the mdl_user database table if you can't access the site, e.g. to look up user "admin" (change this to the user that's getting the 403):
SELECT auth, username FROM mdl_user WHERE username = 'admin';
+--------+----------+
| auth | username |
+--------+----------+
| manual | admin |
+--------+----------+
Can you let us know what the address is for the page where you get the 403? You don't need to include the domain name if you don't want to include the full address of the site, just the bit after (e.g. if the page is https://moodle.example.com/user/editadvanced.php?id=2&course=1&returnto=profile just the /user/editadvanced.php?id=2&course=1returnto=profile part). A screenshot might help (again redact any information you don't want to share, e.g. domain name, user information).
Also please let us know the Moodle version.
