REDHAT-BUG-2543639: Medium severity Moodle Moodle vulnerability
A flaw was found in Moodle. When enrolling a user into a course while selecting a group, a check that the selected group actually belonged to that course was missing, allowing a teacher to add users to groups in courses the teacher could not otherwise access.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A teacher who can enroll a user into a course and select a group can exploit the missing validation. The issue allows that teacher to add users to groups associated with courses the teacher could not otherwise access.
What access is required for exploitation?
The attacker needs teacher-level capability to enroll a user in a course and choose a group during enrollment. No unauthenticated or remote-only attack path is described.
How can administrators identify possible impact?
Review enrollment activity performed by teachers, particularly enrollments where a selected group may belong to a different course. Look for users added to groups in courses that the enrolling teacher was not authorized to access.