Security announcements | Moodle.org

Separate Groups mode restrictions were not factored into permission checks before allowing viewing or deletion of responses in Feedback activities.

Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available (such as those with TeX Live installed).

Guest user sessions were given a longer timeout than authenticated users, which could result in an elevated denial of service risk.

Question bank filtering required additional sanitizing to prevent a reflected XSS risk.

In a database activity with separate groups mode enabled, users who were not in a group (and did not have permission to access all groups) could see entries from members of all groups in the activity, rather than just entries of users also not in any groups. Note: Users within groups worked as intended, only able to see entries belonging to other members of their group(s).

On sites requiring a confirmation step to update a user's email address, the token used to verify the change should only be accessible via the confirmation email, but was otherwise retrievable by the user.

Insufficient checks meant users could see users tagged with a tag, regardless of whether they had access to view the users' profiles.

Insufficient capability checks in a learning plan web service could result in users having the ability to retrieve information they did not have permission to access (such as users' names).

Additional checks were required to ensure users can only access the schedule of a report if they have permission to edit that report.

Additional checks were required to ensure users with permission to view badge recipients can only access lists of those they are intended to have access to.