CVE-2024-48901

What it actually does

Missing permission checks allow users without edit rights on a report to access its schedule details via direct requests.

Why it matters to the business

Attackers with limited access could view scheduled reporting configurations that should be restricted, potentially exposing operational details and sensitive data handling practices.

How an attack unfolds

An authenticated user identifies report schedule endpoints and submits requests for schedules belonging to reports they cannot edit; the application fails to enforce the required edit permission check and returns the schedule data.

How to fix it

Upgrade affected Moodle instances to versions containing the additional permission checks. For listed libarchive packages on Ubuntu 14.04 LTS apply 3.1.2-7ubuntu2.3 and on Ubuntu 16.04 LTS apply 3.1.2-11ubuntu0.16.04.2.

How to confirm the fix worked

Confirm the presence of updated Moodle code that performs explicit edit-permission checks before returning schedule data; test by attempting schedule access with a user lacking edit rights and verify denial.

Typical attack path

1. Obtain a low-privileged authenticated session in Moodle
2. Discover or guess report schedule access URLs or API endpoints
3. Submit requests for schedules tied to reports without holding edit permission
4. Receive unauthorized schedule information due to absent authorization enforcement

How to detect it

Review web server and application logs for requests to report schedule endpoints by users who do not hold edit rights on the referenced report; correlate with authentication and authorization events.

What your security team should do

• Apply the permission-check fix to all Moodle instances immediately
• Audit existing report schedules for unintended visibility after patching
• Review and tighten report-related permission assignments across the platform