[MEDIUM] Moodle has an IDOR in messaging web service which allows access to some user details

PKSA-pr46-vm59-kn4p CVE-2025-3645 GHSA-pj96-xh2w-fgqx

Affected package: moodle/moodle

Affected version: >=4.5.0-beta,<4.5.4|>=4.4.0-beta,<4.4.8|>=4.3.0-beta,<4.3.12|<4.1.18

Reported by:
GitHub