CVE-2024-25981

What it actually does

Authorization bypass in forum export functionality that ignores Separate Groups mode restrictions, exposing forum data across all groups to non-editing teachers.

Why it matters to the business

Limited unauthorized disclosure of group-specific discussion content that may contain sensitive student or participant information; low operational urgency given stable low exploit probability and absence from known exploited lists.

How an attack unfolds

An authenticated non-editing teacher enrolled in a course configured with Separate Groups mode navigates to the forum export feature and triggers an export; the missing group filter returns posts and participant data from every group rather than only the attacker's assigned groups.

How to fix it

Upgrade Moodle to a version containing commit 8a38a37f1ff5075c6f46d726c1457172c2fccac3 or later; verify the fix is present by confirming the updated export logic respects group membership before re-enabling exports.

How to confirm the fix worked

After upgrade, create test courses with Separate Groups, populate multiple groups with distinct posts, export as non-editing teacher, and confirm only the assigned group's data appears in the output.

Typical attack path

1. Locate a Moodle course using Separate Groups mode with forum activity
2. Log in with non-editing teacher privileges
3. Access the forum export option without additional parameters
4. Receive exported data containing posts from all groups

How to detect it

Search Moodle web server and database logs for forum export requests initiated by users holding non-editing teacher roles in courses with group mode enabled; correlate with timestamps of large data exports or downloads of forum content.

What your security team should do

• Apply the fixed commit or corresponding release to all Moodle instances within standard change windows
• Review audit logs for any forum export events performed by non-editing teachers prior to the fix
• Temporarily disable forum exports for non-editing teachers until patched if risk tolerance is low