Moodle 4.1.21 4.1 no longer receives security fixesLTS

User list filters allowed managers to filter by user profile fields that they could not view on users' profiles.

Insufficient username escaping could allow a minor XSS risk if an unauthenticated user was tricked into opening a password reset link (so did not affect authenticated user sessions).

An incorrect capability check in the AI "generate image" web service could allow users to access that feature without having the "generate image" capability.

The manual enrolment management page did not prevent direct access when the plugin was disabled and a link was no longer available in the UI. Note: This still required the relevant capability to access the page (had it been enabled).

Insufficient escaping resulted in an XSS risk in some templates used to display forum posts.

Insufficient validation of the audience classname in report builder allowed arbitrary class instantiation.

The report builder fragment output callbacks did not verify that the requesting user had the required capability to access the requested report, potentially allowing users to retrieve report data beyond their permitted access.

A blind SSRF risk was identified in the MNet peers management functionality, due to missing validation of peer hostnames against the cURL blocked hosts configuration. Note: This feature is only available to site administrators.

Capability checks were missing from course assistance AI placement web services, which could allow users to make requests to those AI course assistance web services without having the relevant capabilities (if those features are enabled).

The quiz feature to add section headings did not include the necessary token to prevent a CSRF risk.

The actions to enable and disable group messaging did not include the necessary token to prevent a CSRF risk.

The Feedback activity module's import functionality required additional sanitizing to prevent a reflected XSS risk.

The user profile page reset action did not include the necessary token to prevent a CSRF risk.

The setting for users to set their own homepage preference did not include the necessary token to prevent a CSRF risk.

Missing group access checks in some grade web services could allow a user to access grade and user information for students in groups they did not have permission to view.

Insufficient CSRF token and capability checks were applied to an MNet admin setting.

The upstream AWS SDK for PHP library was upgraded, which included a security fix.

A flaw in message handling of conversations with deleted users could result in active users losing access to their private messages.

When blind marking is enabled for an assignment, user IDs remained visible on the assignment submissions page instead of being masked.

Badges being awarded with a role performed the correct capability check, but did not verify the user had the required role to meet the award criterion.

Forum ratings required additional permission checks to prevent users from being able to view ratings they did not have the capability to access.

Insufficient checks on a confirmation email web service made it easier to brute force password checks against known usernames.

An open redirect risk existed in the OAuth login functionality.