diff --git a/grade/report/grader/ajax_callbacks.php b/grade/report/grader/ajax_callbacks.php
index 078b22ea52b..0c7ae059a42 100644
--- a/grade/report/grader/ajax_callbacks.php
+++ b/grade/report/grader/ajax_callbacks.php
@@ -35,6 +35,7 @@ if (!$course = $DB->get_record('course', array('id' => $courseid))) {
 }
 $context = get_context_instance(CONTEXT_COURSE, $course->id);
 require_login($course);
+confirm_sesskey();
 
 switch ($action) {
     case 'update':