The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers about attempts/users in groups they should not have access to.
{ "github_reviewed_at": "2024-04-23T23:43:22Z", "severity": "MODERATE", "cwe_ids": [ "CWE-668", "CWE-862" ], "github_reviewed": true, "nvd_published_at": "2022-09-30T17:15:00Z" }