The last time a user accessed the mobile app is displayed on their profile page, but should be restricted to users with the relevant capability (site administrators by default).
| Severity/Risk: | Minor |
| Versions affected: | 3.10 to 3.10.3 |
| Versions fixed: | 3.11 and 3.10.4 |
| Reported by: | Strifel |
| CVE identifier: | CVE-2021-32477 |
| Changes (master): | http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-71513 |
| Tracker issue: | MDL-71513 Last app access time is visible to non-site-admins on user profile page |