Open Redirect Vulnerability in Chamilo LMS Affects Administrators
CVE-2026-32932
4.7MEDIUM
What is CVE-2026-32932?
Chamilo LMS, a popular learning management system, has an Open Redirect vulnerability that affects authenticated administrators. This security flaw allows attackers to redirect admins to malicious external URLs upon saving changes to coach assignments, facilitating potential session hijacking and data leaks. The id_session parameter can also be unintentionally shared with the attacker's server, posing further risks to user data integrity. Update to versions 1.11.38 or 2.0.0-RC.3 to mitigate this vulnerability.
Affected Version(s)
chamilo-lms < 1.11.38 < 1.11.38
chamilo-lms >= 2.0.0-alpha.1, < 2.0.0-RC.3 < 2.0.0-alpha.1, 2.0.0-RC.3