In Moodle, insufficient capability checks meant message deletions were not limited to the current user.
{ "cpes": [ "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*" ], "severity": "Medium" }