Moodle has a database activity export permission issue where the export function of the database activity module exports all entries even those from groups the user does not belong to
Severity
CVSS 3.1
7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
2.1% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-31)