Insufficient capability checks could allow users with the moodle/site:uploadusers capability to delete users, without having the necessary moodle/user:delete capability.
| Severity/Risk: | Minor |
| Versions affected: | 3.11 to 3.11.5, 3.10 to 3.10.9, 3.9 to 3.9.12 and earlier unsupported versions |
| Versions fixed: | 3.11.6, 3.10.10 and 3.9.13 |
| Reported by: | Chris Pratt |
| Workaround: | Remove the moodle/site:uploadusers capability from users who do not also have the moodle/user:delete capability, until the patch is applied. |
| CVE identifier: | CVE-2022-0985 |
| Changes (master): | http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-72972 |
| Tracker issue: | MDL-72972 Users with moodle/site:uploadusers but without moodle/user:delete could delete users |