Moodle 5.1.2 5.1 is supported

User list filters allowed managers to filter by user profile fields that they could not view on users' profiles.

Insufficient username escaping could allow a minor XSS risk if an unauthenticated user was tricked into opening a password reset link (so did not affect authenticated user sessions).

A check to validate a group belonged to a course was missing, which made it possible for teachers to add users to groups in courses that the teacher could not otherwise access.

Missing capability checks made it possible for users to trigger grade penalty recalculation without having the capability to do so.

An incorrect capability check in the AI "generate image" web service could allow users to access that feature without having the "generate image" capability.

The manual enrolment management page did not prevent direct access when the plugin was disabled and a link was no longer available in the UI. Note: This still required the relevant capability to access the page (had it been enabled).

Insufficient escaping resulted in an XSS risk in some templates used to display forum posts.

Insufficient validation of the audience classname in report builder allowed arbitrary class instantiation.

The report builder fragment output callbacks did not verify that the requesting user had the required capability to access the requested report, potentially allowing users to retrieve report data beyond their permitted access.

A blind SSRF risk was identified in the MNet peers management functionality, due to missing validation of peer hostnames against the cURL blocked hosts configuration. Note: This feature is only available to site administrators.

Capability checks were missing from course assistance AI placement web services, which could allow users to make requests to those AI course assistance web services without having the relevant capabilities (if those features are enabled).

The quiz feature to add section headings did not include the necessary token to prevent a CSRF risk.

The actions to enable and disable group messaging did not include the necessary token to prevent a CSRF risk.

The Feedback activity module's import functionality required additional sanitizing to prevent a reflected XSS risk.

The user profile page reset action did not include the necessary token to prevent a CSRF risk.

The setting for users to set their own homepage preference did not include the necessary token to prevent a CSRF risk.

Missing group access checks in some grade web services could allow a user to access grade and user information for students in groups they did not have permission to view.

Insufficient CSRF token and capability checks were applied to an MNet admin setting.

The upstream AWS SDK for PHP library was upgraded, which included a security fix.

The grade penalty rules reset function did not include the necessary token to prevent a CSRF risk.

A flaw in message handling of conversations with deleted users could result in active users losing access to their private messages.