GHSA-5RR5-FXHC-JV64 Moodle allows attackers to modify the visibility of a badge

badges/mybadges.php in Moodle 2.5.x before 2.5.5 and 2.6.x before 2.6.2 does not properly track the user to whom a badge was issued, which allows remote authenticated users to modify the visibility of an arbitrary badge via unspecified vectors...

Information Disclosure

Moodle is vulnerable to information disclosure attacks. The library does not check the ownership of a users' badge, allowing a malicious user to toggle the visibility of another user's badge...