Security announcements | Moodle.org

Guest user sessions were given a longer timeout than authenticated users, which could result in an elevated denial of service risk.

Question bank filtering required additional sanitizing to prevent a reflected XSS risk.

In a database activity with separate groups mode enabled, users who were not in a group (and did not have permission to access all groups) could see entries from members of all groups in the activity, rather than just entries of users also not in any groups. Note: Users within groups worked as intended, only able to see entries belonging to other members of their group(s).

On sites requiring a confirmation step to update a user's email address, the token used to verify the change should only be accessible via the confirmation email, but was otherwise retrievable by the user.

Insufficient checks meant users could see users tagged with a tag, regardless of whether they had access to view the users' profiles.

Insufficient capability checks in a learning plan web service could result in users having the ability to retrieve information they did not have permission to access (such as users' names).

Additional checks were required to ensure users can only access the schedule of a report if they have permission to edit that report.

Additional checks were required to ensure users with permission to view badge recipients can only access lists of those they are intended to have access to.

Additional checks were required to ensure users can only fetch the list of course badges for courses they are intended to have access to.

Users with access to delete audiences from some reports could delete audiences from other reports they did not have permission to delete from.