CVE-2021-32472

Vulnerability

In Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, and 3.8 to 3.8.8, the CSV export functionality for forums fails to properly scope the export to the user's own course. When a teacher with the capability to export a forum in CSV format initiates an export, the system may unexpectedly include forum data from all courses, not just the course where the teacher is assigned [1].

Exploitation

An authenticated user with a teacher role that has the required forum export capability in at least one course can trigger the vulnerability by performing a standard CSV export of a forum. The export operation then returns a CSV file containing forum posts from all courses, bypassing the intended course-level restriction. No additional privileges or user interaction beyond the export action are needed [1].

Impact

Successful exploitation leads to unauthorized information disclosure, specifically the contents of forum posts from courses the teacher is not assigned to. This violates course-level access controls and can expose sensitive discussions, student contributions, or institutional data to users who should not have access [1].

Mitigation

The issue is fixed in Moodle versions 3.10.4, 3.9.7, and 3.8.9, released after the vulnerability was addressed. Administrators should upgrade to these patched versions or later. No workaround is documented; the only mitigation is to apply the available security update [1].