Security announcements | Moodle.org

The XML grade import functionality (which allows setting or overwriting of student grades) did not include the necessary token to prevent a CSRF risk.

User list filters allowed managers to filter by user profile fields that they could not view on users' profiles.

Insufficient username escaping could allow a minor XSS risk if an unauthenticated user was tricked into opening a password reset link (so did not affect authenticated user sessions).

A check to validate a group belonged to a course was missing, which made it possible for teachers to add users to groups in courses that the teacher could not otherwise access.

Missing capability checks made it possible for users to trigger grade penalty recalculation without having the capability to do so.

An incorrect capability check in the AI "generate image" web service could allow users to access that feature without having the "generate image" capability.

The manual enrolment management page did not prevent direct access when the plugin was disabled and a link was no longer available in the UI. Note: This still required the relevant capability to access the page (had it been enabled).

Insufficient escaping resulted in an XSS risk in some templates used to display forum posts.

Insufficient validation of the audience classname in report builder allowed arbitrary class instantiation.

An incorrect capability check in a grade web service allowed students to access profile information of other students enrolled in the same course, which they would not otherwise have access to.