I've tried filing a bug report but as a 'new' bug tracker user, it doesn't seem to want to let me.
Can anyone else confirm if their sites have this issue? I'm using 3.11.2+ (Build: 20210820)
The permission 'moodle/grade:viewall' does not seem to be being respected. Eg I have this disabled for students, and yet students are able to view other students' grades! The access route was course participants -> user profile page -> click the 'Grades' link on the RHS. I've turned off the 'Participants' and 'view profiles' permissions (this is being respected) but I've noted that if students use their browser history to go direct to the /course/user.php?mode=grade&id=XXX&user=YYY URL they can still view the grades of another student on their course....