Insecure Direct Object Reference in Chamilo LMS Gradebook Allows Unauthorized Grade Deletion
CVE-2026-32894
7.1HIGH
What is CVE-2026-32894?
Chamilo LMS, a popular learning management system, contains a significant vulnerability that allows authenticated teachers to delete any student's grades without proper verification. This vulnerability stems from the system's failure to enforce ownership and course-scope checks when processing requests to delete grade results. By manipulating specific GET parameters, attackers could exploit this flaw to alter student records indiscriminately. The issue has been addressed in the latest versions, 1.11.38 and 2.0.0-RC.3, which incorporate essential security measures to prevent such unauthorized access.
Affected Version(s)
chamilo-lms < 1.11.38 < 1.11.38
chamilo-lms >= 2.0.0-alpha.1, < 2.0.0-RC.3 < 2.0.0-alpha.1, 2.0.0-RC.3