The issue is related to insufficient access control in the question engine service of the Moodle learning management system. This can allow a remote attacker to breach information confidentiality. The question engine allows access to files that should not be available.