CVE-2025-62393: Moodle course access permissions are not properly checked in course_output_fragment_course_overview

The analysis of the provided security patch (commit fc69b4744ba0132cc3093fd81940be15bc293835) clearly indicates a vulnerability within the course_output_fragment_course_overview function in the file public/course/lib.php. The vulnerability is a classic case of improper access control. The original code called the can_access_course function, which is intended to check if a user has the rights to view a course. However, the code did not check the boolean value returned by this function. As a result, the function would proceed to load and display course information regardless of the user's permissions. The patch rectifies this by wrapping the can_access_course call in a conditional that throws a require_login_exception if the check fails, thus properly enforcing access control. Therefore, the course_output_fragment_course_overview function is the vulnerable function that would appear in a runtime profile when this vulnerability is triggered.