Security announcements | Moodle.org

The report builder fragment output callbacks did not verify that the requesting user had the required capability to access the requested report, potentially allowing users to retrieve report data beyond their permitted access.

User profile descriptions for authenticated users posed a denial of service risk due to the absence of a defined maximum length.

A blind SSRF risk was identified in the MNet peers management functionality, due to missing validation of peer hostnames against the cURL blocked hosts configuration. Note: This feature is only available to site administrators.

Insufficient capability checks in the Assignment module's marker allocation functionality allowed users without the required capability to allocate markers to submissions.

The regrade action in the quiz overview report did not include the necessary token to prevent a CSRF risk.

Capability checks were missing from course assistance AI placement web services, which could allow users to make requests to those AI course assistance web services without having the relevant capabilities (if those features are enabled).

The quiz feature to add section headings did not include the necessary token to prevent a CSRF risk.

The actions to enable and disable group messaging did not include the necessary token to prevent a CSRF risk.

The grade item ID number editing functionality did not include the necessary token to prevent a CSRF risk and also lacked sufficient output sanitizing to prevent an XSS risk.

The Feedback activity module's import functionality required additional sanitizing to prevent a reflected XSS risk.