Security announcements | Moodle.org

Suspended users were not prevented from authenticating via the LTI Provider

A remote code execution risk was identified in the file restore functionality.

There was a behaviour that made it possible for a student to bypass the timed restriction on a timed assignment.

Insufficient capability checks meant users with the capability to create group events, but without the capability to view hidden groups, could see hidden and separate groups in the list of groups to select for calendar events.

It was possible to brute force password checks against known usernames when the mobile client and auth_webservice were enabled.

Incorrect handling of some endpoints during login made it possible to bypass the second factor of multi-factor authentication. Note: A valid username and password were still required to log in.

The router made it possible to determine valid course IDs due to inconsistent handling of valid and non-existent course IDs.

Incorrect error handling in the routing system could result in the application directories being listed if the "Accept text/html" header was not configured.

Insufficient capability checks meant a user with permission to manage/view cohorts in a lower context could retrieve data about cohorts defined in the system context, that they would not otherwise have access to.

Insufficient enrolment checks could result in quiz notifications being sent to users who had an inactive enrolment in the course (such as being suspended or past their enrolment end date).