Missing Authorization Vulnerability in Chamilo LMS by Chamilo
CVE-2026-114389

5.3MEDIUM

Key Information:

Vendor

Chamilo

Status
Chamilo-lms
Vendor
CVE Published:
21 October 2026

What is CVE-2026-114389?

Chamilo LMS before version 2.0.0-RC.3 is affected by a missing authorization vulnerability in the AiController::openAnswerGrade method. This flaw allows authenticated users to access and exploit AI grading for other students' exam attempts. Attackers can manipulate exeId and questionId values sent to the open_answer_grade endpoint, potentially revealing sensitive feedback and compromising the privacy of other students' responses. This vulnerability highlights the importance of implementing adequate access controls to safeguard user data within the application.

Affected Version(s)

chamilo-lms 2.0.0-alpha.4 < 2.0.0-RC.3

References

https://github.com/chamilo/chamilo-lms/issues/7671
issue-tracking
https://github.com/chamilo/chamilo-lms/commit/2861afd4896...
patch
https://github.com/chamilo/chamilo-lms/releases/tag/v2.0....
release-notes

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lighthousekeeper1212
leediay153 from Viettel Post
.