Moodle Feedback Separate Groups Mode Permission Bypass Vulnerability

A vulnerability exists in Moodle's Feedback module, specifically in versions 4.5 prior to 4.5.1, 4.4 prior to 4.4.5, 4.3 prior to 4.3.9, 4.1 prior to 4.1.15, and earlier unsupported versions. The issue arises because permission checks did not properly consider Separate Groups mode restrictions, allowing inappropriate viewing or deletion of feedback responses.

Impact

Exploitation of this vulnerability could lead to unauthorized viewing or deletion of feedback responses, bypassing group-specific permissions.

Remediation

Users can upgrade to Moodle versions 4.5.2, 4.4.6, 4.3.10, or 4.1.16 to address this vulnerability.