Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: chamilo-lms 2.0.0-RC.3 Clear all filters
TI-2026-78771 CVE-2026-114390 · GHSA-h28r-m2q7-jx9p

Missing authorization in Chamilo LMS AJAX handlers exposes learner data

Priority LOW 36

Chamilo LMS from 2.0.0-alpha.1 before 2.0.0-RC.3 contains a missing authorization vulnerability in legacy AJAX handlers under public/main/inc/ajax/ that exposes user names and certificates.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00227 Published 2026-10-21 Fixed in 2.0.0-RC.3 CWE-862
TI-2026-78770 CVE-2026-114389 · GHSA-f6m7-pgw8-2v88

Chamilo LMS open answer grading lets users grade others' exams

Priority LOW 24

Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in AiController::openAnswerGrade that allows any authenticated user to obtain AI grading of other students' exam attempts.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00274 Published 2026-10-21 Fixed in 2.0.0-RC.3 CWE-639
TI-2026-78769 CVE-2026-114388 · GHSA-xf7w-4v4m-pq7h

Chamilo LMS missing authorization lets attackers change course certificates

Priority LOW 36

Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in GradebookController that allows unauthenticated users to modify gradebook certificates.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00167 Published 2026-10-21 Fixed in 2.0.0-RC.3 CWE-862