Moodle Calendar Event Creation Privilege Escalation Vulnerability

A vulnerability in Moodle allows users with permission to create calendar events to see the names of hidden groups. This issue arises because the event creation process lacks proper capability checks, inadvertently exposing private group information that should remain confidential within a course. The vulnerability affects Moodle versions 5.0 prior to 5.0.3, 4.5 prior to 4.5.7, 4.4 prior to 4.4.11, 4.1 prior to 4.1.21, and earlier unsupported versions.

Impact

Exploitation of this vulnerability could lead to unauthorized exposure of sensitive group information, including private or restricted group names.

Remediation

Users can upgrade to Moodle versions 5.0.3, 4.5.7, 4.4.11, or 4.1.21 to address this vulnerability.