Group visibility was not taken into account when generating SQL for getting enrolled users restricted to a list of groups. This may have allowed users to infer membership of groups they were not allowed to see members of.