Moodle Improper Access Control Vulnerability in Cohort Search Web Service

An improper access control vulnerability has been identified in Moodle's cohort search web service. This flaw allows users with permissions in lower contexts to access cohort information from the system context, thereby revealing restricted administrative data. The vulnerability affects Moodle versions 5.0 prior to 5.0.3, 4.5 prior to 4.5.7, 4.4 prior to 4.4.11, 4.1 prior to 4.1.21, and earlier unsupported versions.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive administrative information by allowing users to access higher-level cohort data that should be restricted.

Remediation

Users can upgrade to Moodle versions 5.0.3, 4.5.7, 4.4.11, or 4.1.21 to address this vulnerability.