medium6.5
CVE-2025-26526
Moodle's feedback response viewing and deletions did not respect Separate Groups mode
Impact
Separate Groups mode restrictions were not factored into permission checks before allowing viewing or deletion of responses in Feedback activities.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | moodle/moodle | >= 4.5.0-beta, < 4.5.2 | 4.5.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Moodle | Moodle | from 4.1.0 before 4.1.16 from 4.3.0 before 4.3.10 from 4.4.0 before 4.4.6 from 4.5.0 before 4.5.2 |