[MEDIUM] Moodle has an IDOR in web service which allows users enrolled in a course to access some details of other users

PKSA-mj2r-6dr9-xghp CVE-2025-3640 GHSA-6g5x-h5x7-q4mq

Affected package: moodle/moodle

Affected version: >=4.5.0-beta,<4.5.4|>=4.4.0-beta,<4.4.8|>=4.3.0-beta,<4.3.12|<4.1.18

Reported by:
GitHub