CVE-2025-62400: Moodle exposed the names of hidden groups to users

The vulnerability exists because Moodle was using an insecure method to retrieve group information for the calendar event form. The functions core_calendar_external::submit_create_update_form and calendar_output_fragment_event_form both utilized groups_get_course_data(), which fetched all groups within a course, failing to check if the user had the necessary permissions to view them. This allowed users with calendar event creation permissions to see the names of all groups, including those that were hidden. The patch addresses this by replacing the insecure function call with groups_get_all_groups(), which correctly respects group visibility settings and user capabilities. Therefore, any user who could trigger the creation or editing of a calendar event would cause these vulnerable functions to be executed, leading to the disclosure of sensitive group information.