CVE-2024-43438

What it actually does

Missing authorization verification in the Feedback activity non-respondents report allows bulk messages to be sent to user IDs outside the set returned by the report.

Why it matters to the business

Attackers with report access can contact arbitrary users, potentially causing privacy violations, unwanted communications, or abuse of internal messaging.

How an attack unfolds

An authenticated user with access to a Feedback activity opens the non-respondents report, then submits a bulk message request containing recipient identifiers that fall outside the reported user set; the missing check permits the messages to be delivered anyway.

How to fix it

Update Moodle to the commit aea9770cfc7d003a737f4899489d1e3982efe9ac or later; verify the authorization check is present in the bulk messaging code path.

How to confirm the fix worked

Confirm the patched commit is deployed, then test that bulk messages from the non-respondents report are rejected when recipients are not in the report result set.

Typical attack path

1. Obtain access to a Feedback activity report
2. Navigate to the non-respondents report view
3. Craft and submit a bulk message payload with unauthorized recipient IDs
4. Messages are delivered without recipient validation

How to detect it

Inspect application logs for bulk message submissions originating from Feedback reports and compare recipient lists against the actual report output for mismatches.

What your security team should do

• Apply the fixed commit across all Moodle instances
• Audit permissions for users who can view Feedback reports
• Review message logs for any anomalous bulk sends after the patch date