Executive brief
Chamilo LMS, a popular open-source learning management system, contains a security flaw in its gradebook component. An authenticated teacher can view or modify the grading criteria (such as names, maximum scores, and weights) of evaluations in courses they do not own. This could lead to unauthorized changes in academic records and compromise the integrity of student grading across the entire platform.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in 'gradebook_edit_eval.php' due to insufficient ownership validation. While the application blocks students and anonymous users, it fails to verify if the authenticated teacher has authority over the specific evaluation ID provided in the 'editeval' GET parameter. The 'Evaluation::load()' method fetches records from the 'gradebook_evaluation' table using sequential integer IDs without course-scoping filters. An attacker with teacher-level privileges can enumerate these IDs to view or modify the name, maximum score, and weight of evaluations in any course on the platform. This issue is resolved in versions 1.11.38 and 2.0.0-RC.3.
Affected products
- Chamilo Chamilo LMS < 1.11.38, < 2.0.0-RC.3
Timeline
- 2026-04-10: advisory: Vendor advisory published via GitHub
- 2026-04-10: disclosed: CVE-2026-32930 published
- 2026-04-10: patched: Fixes merged into main and 2.0 branches