mod/forum/post.php in Moodle 2.9.x before 2.9.1 does not consider the mod/forum:canposttomygroups capability before authorizing Post a copy to all groups actions, which allows remote authenticated users to bypass intended access restrictions by leveraging per-group authorization.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Moodle | Moodle | 2.9.0 (including) | 2.9.0 (including) |
| Moodle | Ubuntu | upstream | * |