Missing Access Control in Chamilo LMS Allows Unauthenticated Modifications
CVE-2026-114388

6.9MEDIUM

Key Information:

Vendor

Chamilo

Status
Chamilo-lms
Vendor
CVE Published:
21 October 2026

What is CVE-2026-114388?

Chamilo LMS versions prior to 2.0.0-RC.3 exhibit a vulnerability in the GradebookController that permits unauthenticated users to manipulate gradebook certificates. By exploiting the set_default_certificate endpoint, attackers can specify any course ID and document ID, enabling them to alter certificate configurations for various courses. This flaw could lead to unauthorized modifications that impact the integrity of the gradebook system.

Affected Version(s)

chamilo-lms 2.0.0-alpha.1 < 2.0.0-RC.3

References

https://github.com/chamilo/chamilo-lms/issues/7671
issue-tracking
https://github.com/chamilo/chamilo-lms/commit/2861afd4896...
patch
https://github.com/chamilo/chamilo-lms/releases/tag/v2.0....
release-notes

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lighthousekeeper1212
leediay153 from Viettel Post
.