[Building Sakai] samigo privilege escalation?

[D. Stuart Freeman]

We've received a report of an instructor witnessing a student viewing her
samigo question pool. The student was having trouble starting an
assessment, called the instructor over, and the instructor reports seeing
the question pools on the student's screen.

Our event table dosn't show anything out of the ordinary for the two
accounts involved, and switching user to the student account doesn't allow
us to look at the pools.

Has anyone else seen anything like this, or have any ideas what might
cause it? (In case you're wondering we're on 2.5.x, but jira hasn't
turned up anything that looks relevant).

-- 
D. Stuart Freeman
Georgia Institute of Technology
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: Digital signature
Url : http://collab.sakaiproject.org/pipermail/sakai-dev/attachments/20110701/e3019c96/attachment.bin