Security announcements | Moodle.org

Insufficient checks meant users could see users tagged with a tag, regardless of whether they had access to view the users' profiles.

Insufficient capability checks in a learning plan web service could result in users having the ability to retrieve information they did not have permission to access (such as users' names).

Additional checks were required to ensure users can only access the schedule of a report if they have permission to edit that report.

Additional checks were required to ensure users with permission to view badge recipients can only access lists of those they are intended to have access to.

Additional checks were required to ensure users can only fetch the list of course badges for courses they are intended to have access to.

Users with access to delete audiences from some reports could delete audiences from other reports they did not have permission to delete from.

Additional checks were required to ensure users can only edit or delete RSS feeds they have permission to modify.

It was possible for users with the "send message" capability to view other users' names they may not otherwise have access to, via an error message in Messaging. (Note: The name returned followed the full name format configured on the site).

When restricting access to a Lesson activity with a password, certain passwords could be bypassed/less secure due to a loose comparison in the password checking logic.

Note: this only affected passwords that are set to "magic hash" values. These are certain values where a loose comparison in the code can result in multiple values "matching" the password, instead of the expected behaviour that only an exact match for the password will be accepted.

Additional checks were required to ensure users can only delete their own OAuth2 linked accounts.