Security announcements | Moodle.org

There was a behaviour that made it possible for a student to bypass the timed restriction on a timed assignment.

Insufficient capability checks meant users with the capability to create group events, but without the capability to view hidden groups, could see hidden and separate groups in the list of groups to select for calendar events.

It was possible to brute force password checks against known usernames when the mobile client and auth_webservice were enabled.

Incorrect handling of some endpoints during login made it possible to bypass the second factor of multi-factor authentication. Note: A valid username and password were still required to log in.

The router made it possible to determine valid course IDs due to inconsistent handling of valid and non-existent course IDs.

Incorrect error handling in the routing system could result in the application directories being listed if the "Accept text/html" header was not configured.

Insufficient capability checks meant a user with permission to manage/view cohorts in a lower context could retrieve data about cohorts defined in the system context, that they would not otherwise have access to.

Insufficient enrolment checks could result in quiz notifications being sent to users who had an inactive enrolment in the course (such as being suspended or past their enrolment end date).

The upstream FPDI library was upgraded, which included a security fix.

Insufficient handling of course access checks in a course overview function could results in the information being returned to a user who did not have access to the course.