Unauthorized report audience deletion via mismatched IDs

Missing authorization in Moodle LMS allows remote authenticated users to delete audiences from reports they are not permitted to manage. The reportbuilder audience deletion endpoint accepted a report ID and an unrelated audience instance ID, then authorized the report and deleted the independently selected audience without verifying that both records belonged together. Access to delete an audience on at least one report is required, and exploitation removes saved audience configuration from a different report without granting access to its contents.