diff --git a/lang/en/my.php b/lang/en/my.php
index ea1e7347edd..a4c05519a30 100644
--- a/lang/en/my.php
+++ b/lang/en/my.php
@@ -38,3 +38,4 @@ $string['reseteveryonesdashboard'] = 'Reset Dashboard for all users';
 $string['reseteveryonesprofile'] = 'Reset profile for all users';
 $string['resetpage'] = 'Reset page to default';
 $string['reseterror'] = 'There was an error resetting your page';
+$string['unabletoaccess'] = 'As a security precaution, you may not access another user\'s dashboard';
diff --git a/my/index.php b/my/index.php
index cd2b8cf1593..8bd9ec1d277 100644
--- a/my/index.php
+++ b/my/index.php
@@ -45,6 +45,13 @@ $reset  = optional_param('reset', null, PARAM_BOOL);
 
 require_login();
 
+if (\core\session\manager::is_loggedinas()) {
+    // Disable access to the user's dashboard for "logged in as" sessions
+    // to mitigate risks associated with loading other users' JavaScript.
+    // See MDL-63786 for more information.
+    redirect(new moodle_url('/', ['redirect' => 0]), get_string('unabletoaccess', 'core_my'));
+}
+
 $hassiteconfig = has_capability('moodle/site:config', context_system::instance());
 if ($hassiteconfig && moodle_needs_upgrading()) {
     redirect(new moodle_url('/admin/index.php'));