Moodle 5.0.0 5.0 is supported

User list filters allowed managers to filter by user profile fields that they could not view on users' profiles.

Insufficient username escaping could allow a minor XSS risk if an unauthenticated user was tricked into opening a password reset link (so did not affect authenticated user sessions).

Missing capability checks made it possible for users to trigger grade penalty recalculation without having the capability to do so.

An incorrect capability check in the AI "generate image" web service could allow users to access that feature without having the "generate image" capability.

The manual enrolment management page did not prevent direct access when the plugin was disabled and a link was no longer available in the UI. Note: This still required the relevant capability to access the page (had it been enabled).

Insufficient escaping resulted in an XSS risk in some templates used to display forum posts.

Insufficient validation of the audience classname in report builder allowed arbitrary class instantiation.

The report builder fragment output callbacks did not verify that the requesting user had the required capability to access the requested report, potentially allowing users to retrieve report data beyond their permitted access.

A blind SSRF risk was identified in the MNet peers management functionality, due to missing validation of peer hostnames against the cURL blocked hosts configuration. Note: This feature is only available to site administrators.

Capability checks were missing from course assistance AI placement web services, which could allow users to make requests to those AI course assistance web services without having the relevant capabilities (if those features are enabled).

The quiz feature to add section headings did not include the necessary token to prevent a CSRF risk.

The actions to enable and disable group messaging did not include the necessary token to prevent a CSRF risk.

The Feedback activity module's import functionality required additional sanitizing to prevent a reflected XSS risk.

The user profile page reset action did not include the necessary token to prevent a CSRF risk.

The setting for users to set their own homepage preference did not include the necessary token to prevent a CSRF risk.

Missing group access checks in some grade web services could allow a user to access grade and user information for students in groups they did not have permission to view.

Insufficient CSRF token and capability checks were applied to an MNet admin setting.

The upstream AWS SDK for PHP library was upgraded, which included a security fix.

The grade penalty rules reset function did not include the necessary token to prevent a CSRF risk.

A flaw in message handling of conversations with deleted users could result in active users losing access to their private messages.

When blind marking is enabled for an assignment, user IDs remained visible on the assignment submissions page instead of being masked.

Badges being awarded with a role performed the correct capability check, but did not verify the user had the required role to meet the award criterion.

Forum ratings required additional permission checks to prevent users from being able to view ratings they did not have the capability to access.

Insufficient checks on a confirmation email web service made it easier to brute force password checks against known usernames.

An open redirect risk existed in the OAuth login functionality.

There was a behaviour that made it possible for a student to bypass the timed restriction on a timed assignment.

Insufficient capability checks meant users with the capability to create group events, but without the capability to view hidden groups, could see hidden and separate groups in the list of groups to select for calendar events.

It was possible to brute force password checks against known usernames when the mobile client and auth_webservice were enabled.

The router made it possible to determine valid course IDs due to inconsistent handling of valid and non-existent course IDs.

Incorrect error handling in the routing system could result in the application directories being listed if the "Accept text/html" header was not configured.

Insufficient capability checks meant a user with permission to manage/view cohorts in a lower context could retrieve data about cohorts defined in the system context, that they would not otherwise have access to.

Insufficient enrolment checks could result in quiz notifications being sent to users who had an inactive enrolment in the course (such as being suspended or past their enrolment end date).

Insufficient handling of course access checks in a course overview function could results in the information being returned to a user who did not have access to the course.

Insufficient capability checks meant a callback designed to allow plugins to control user profile access did not correctly limit access in some web service functions.

Feedback activity results for all groups in Separate Groups mode could be viewed by non-editing teachers when they were not a member of any group.

Separate Groups mode restrictions were not honoured when viewing a course's Logs report, so actions of all course participants were displayed in the report. By default this only provided additional access to non-editing teachers.

A stricter capability check was required to restrict which users can fetch other users' recently accessed courses information.

The "move up" and "move down" actions in backpack management for badges did not include the necessary token to prevent a CSRF risk.

Additional cache controls were required to prevent web browsers caching a user's password on the login page (note accessing this would require access to the web browser on the device where the user had logged in).