A flaw was found in Moodle. An incorrect capability check in the AI editor placement's "generate image" web service allowed a user to invoke that feature without holding the required capability. The advisory does not state the exact privilege level of an affected user; this draft assumes access is limited to users who already hold some content-editing role rather than a fully anonymous or lowest-privilege user.