Unauthorised Arbitrary File Downloads

Moodle is vulnerable to unauthorised arbitrary file downloads. It is possible because any authorized student with access to portfolio forum caller class can change the download URL to download any files...