Moodle Quiz Notification Vulnerability for Inactive Users

A vulnerability in Moodle's quiz notification system allows suspended or inactive users to receive messages about quizzes. This issue arises from improper verification of enrolment status, which can inadvertently disclose limited course information to these users. The vulnerability affects Moodle versions 5.0 prior to 5.0.3 and 4.5 prior to 4.5.7.

Impact

Exploitation of this vulnerability could lead to unauthorized access to quiz-related information, allowing inactive users to receive notifications that could include details about ongoing assessments.