Executive brief
Chamilo LMS is a popular open-source learning management system used by educational institutions to manage courses and student grades. A security flaw allows any user with a teacher account to delete student grades from any course on the platform, even those they do not manage. This could lead to the permanent loss of academic records and disrupt school operations.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the gradebook result view page (gradebook_view_result.php). The application fails to perform ownership or course-scope verification when processing the 'delete_mark' or 'resultdelete' GET parameters. An authenticated teacher can provide any result ID to trigger the delete() method on the corresponding object, enabling cross-course data deletion. Additionally, the 'resultdelete' path lacks a null check, allowing an attacker to cause a PHP fatal error (denial of service) by providing a non-existent ID. The issue is fixed in versions 1.11.38 and 2.0.0-RC.3.
Affected products
- Chamilo Chamilo LMS < 1.11.38, < 2.0.0-RC.3
Timeline
- 2026-04-10: advisory: Vendor advisory published via GitHub
- 2026-04-10: disclosed: CVE-2026-32894 published
- 2026-04-10: patched: Fixes released in 1.11.38 and 2.0.0-RC.3