-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | < 2.5.7 | 2.5.7 |
| moodle/moodle | composer | >= 2.6.0, < 2.6.4 | 2.6.4 |
| moodle/moodle |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the group selection logic in the forum post form. The original code in mod/forum/classes/post_form.php checked group mode and group count, but didn't validate 'moodle/site:accessallgroups' before offering the 'All participants' option. The commit diff shows the fix added a capability check (has_capability('moodle/site:accessallgroups')) and VISIBLEGROUPS mode check before allowing this option. This matches the CVE description of missing capability enforcement for cross-group posting.
| composer |
| >= 2.7.0, < 2.7.1 |
| 2.7.1 |