Description
The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.
Remediation
References
Related Vulnerabilities
WordPress Plugin Contact Form Email Cross-Site Scripting (1.1.49)
WordPress Plugin A/B Test 'action' Parameter Directory Traversal (1.0.6)
WordPress Plugin Monetize Multiple Vulnerabilities (1.03)
WordPress Plugin Advanced User Registration and Management Cross-Site Scripting (2.3.5)
Django Inefficient Algorithmic Complexity Vulnerability (CVE-2025-64458)