Vulnerability Bulletins

MSA-25-0002: Feedback response viewing and deletions did not respect Separate Groups mode

Affected software	PHP

by Michael Hawkins. Separate Groups mode restrictions were not factored into permission checks before allowing viewing or deletion of responses in Feedback activities.Severity/Risk:MinorVersions affected:4.5 to 4.5.1, 4.4 to 4.4.5, 4.3 to 4.3.9, 4.1 to 4.1.15 and earlier unsupported versionsVersions fixed:4.5.2, 4.4.6, 4.3.10 and 4.1.16Reported by:Leon StringerCVE identifier:CVE-2025-26526Changes More info: https://moodle.org/mod/forum/discuss.php?d=466142&parent=1871272

MSA-25-0002: Feedback response viewing and deletions did not respect Separate Groups mode