Incorrect Default Permissions
In Moodle, insufficient capability checks meant message deletions were not limited to the current user. This issue affects versions prior to 3.9.8, 3.10.x prior to 3.10.5 , and 3.11.x prior to 3.11.1.
CWE-276 - Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.