Moodle: ajax section delete does not respect course_can_delete_section()

Root

Cause

The vulnerability arises from insufficient access control checks in Moodle's course section deletion functionality. While the platform requires appropriate permissions to modify course sections, the deletion operation was missing a critical capability check, allowing users to bypass intended restrictions [1][2].

Attack

Vector

An authenticated user with course access—who does not hold the 'moodle/course:sectiondelete' or similar modification capabilities—can issue requests to delete course sections. The application fails to verify whether the user has the necessary permissions before processing the deletion, effectively making the action available to any user who can interact with the course interface [1][2].

Impact

Successful exploitation permits unauthorized deletion of course sections, potentially removing educational content, activities, and resources that legitimate instructors or administrators have structured. This can disrupt course delivery and require administrative recovery efforts to restore lost data [1][2].

Mitigation

The Moodle project has addressed this issue following the disclosure (tracked as MDL-83994) [3][4]. Administrators are strongly advised to update Moodle installations to the latest patched version that enforces the missing capability checks. No workarounds have been published, and applying the vendor-supplied fix is the recommended course of action.