Read the docs
TI-2026-25378 Aliases CVE-2026-32930

Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Evaluation Edit Without Ownership Check

Priority LOW 31CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the gradebook evaluation edit page allows any authenticated teacher to view and modify the settings (name, max score, weight) of evaluations belonging to any other course by manipulating the editeval GET parameter. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.002 9th percentileScored 2026-11-07
Fix Fixed chamilo-lms (chamilo): 1.11.38, 2.0.0-RC.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
chamilochamilo-lmsbefore 1.11.38; 2.0.0-alpha.1 to before 2.0.0-RC.31.11.38, 2.0.0-RC.3Patch availableCNA
  • chamilo-lms Vendorchamilo Affected before 1.11.38; 2.0.0-alpha.1 to before 2.0.0-RC.3 Fixed in 1.11.38, 2.0.0-RC.3 Patch available CNA

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*before 1.11.38Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha1:*:*:*:*:*:*2.0.0 alpha1Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha2:*:*:*:*:*:*2.0.0 alpha2Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha3:*:*:*:*:*:*2.0.0 alpha3Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha4:*:*:*:*:*:*2.0.0 alpha4Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha5:*:*:*:*:*:*2.0.0 alpha5Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta1:*:*:*:*:*:*2.0.0 beta1Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta2:*:*:*:*:*:*2.0.0 beta2Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta3:*:*:*:*:*:*2.0.0 beta3Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc1:*:*:*:*:*:*2.0.0 rc1Vulnerablechamilo
  • cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:* Versions before 1.11.38 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha1:*:*:*:*:*:* Versions 2.0.0 alpha1 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha2:*:*:*:*:*:* Versions 2.0.0 alpha2 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha3:*:*:*:*:*:* Versions 2.0.0 alpha3 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha4:*:*:*:*:*:* Versions 2.0.0 alpha4 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha5:*:*:*:*:*:* Versions 2.0.0 alpha5 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta1:*:*:*:*:*:* Versions 2.0.0 beta1 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta2:*:*:*:*:*:* Versions 2.0.0 beta2 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta3:*:*:*:*:*:* Versions 2.0.0 beta3 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc1:*:*:*:*:*:* Versions 2.0.0 rc1 Vulnerable ·chamilo
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc2:*:*:*:*:*:*2.0.0 rc2Vulnerablechamilo
  • cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc2:*:*:*:*:*:* Versions 2.0.0 rc2 Vulnerable ·chamilo

Remediation

  • Fix · CNA chamilo-lms (chamilo) Fixed in 1.11.38, 2.0.0-RC.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-32930

References

Patch 2

Advisory 1

  • TI-2025-32070 Chamilo: Evaluation of untrusted user input leads to Remote Code Execution CVSS 3.1CRITICAL 9.8
  • TI-2025-32081 Deserialization of untrusted data in chamilo-lms CVSS 4.0HIGH 8.8
  • TI-2024-32140 Chamilo: Post-Auth Remote Code Execution CVSS 4.0HIGH 8.7
  • TI-2023-03907 Chamilo LMS Unauthenticated Big Upload File Remote Code Execution CVSS 3.1HIGH 8.1
  • TI-2025-32595 Chamilo: Stored XSS Vulnerability via CSV User Import CVSS 3.1HIGH 8.8
  • TI-2024-20321 Chamilo LMS 1.11.26 is vulnerable to Incorrect Access Control via main/auth/profile. CVSS 3.1HIGH 8.8
See all 121 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences