PT-2026-25667 · Educativa · Campus

Published 2026-03-16 · Updated 2026-03-16 · CVE-2026-3110

Mitre

CVSS v4.0

8.7

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Insecure Direct Object Reference (IDOR) vulnerability in Campus Educativa specifically at the endpoint '/administracion/admin usuarios.cgi?filtro estado=T&wAccion=listado xlsx&wBuscar=&wFiltrar=&wOrden=alta usuario&wid cursoActual=[ID]' where the data of users enrolled in the course is exported. Successful exploitation of this vulnerability could allow an unauthenticated attacker to access user data (e.g., usernames, first and last names, email addresses, and phone numbers) and retrieve the data of all users enrolled in courses by performing a brute-force attack on the course ID via a manipulated URL.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-3110

Affected Products

Campus

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-3110 · Security Note
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-educativa-campus · Patch
• https://twitter.com/CVEnew/status/2033583680405569870 · Twitter Post