A flaw in Moodle fails to include the required token when enabling or disabling group messaging, creating a Cross‑Site Request Forgery risk. A remote attacker can trick an authenticated user into clicking a link or submitting a form that changes group messaging preferences, resulting in unauthorized configuration changes. The vulnerability leverages missing CSRF checks rather than granting arbitrary code execution or data exfiltration.

The issue affects all Moodle releases that allow group messaging control without a CSRF token, including all publicly deployed installations of Moodle with the default group messaging module. Specific affected versions are not enumerated in the advisory, so all current users should assume any Moodle instance that supports group messaging may be impacted.

The CVSS score of 3.5 indicates low overall severity, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog, suggesting no documented large‑scale exploitation. The likely attack vector is indirect: an attacker must lure an authenticated user to a malicious link or script; no direct exploitation from an unauthenticated source is described. Due to the absence of a reflected or stored payload, the risk is confined to configuration changes performed by compromised user accounts.