PT-2026-32003 · Unknown · Chamilo Lms

Published 2026-04-10 · Updated 2026-04-11 · CVE-2026-32894

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions prior to 1.11.38 Chamilo LMS versions prior to 2.0.0-RC.3

Description Chamilo LMS contains an Insecure Direct Object Reference (IDOR) issue in the gradebook result view page. An authenticated teacher can delete any student's grade result by manipulating the delete mark or resultdelete GET parameters. There is no ownership or course-scope verification performed.

Recommendations Update to version 1.11.38 or later. Update to version 2.0.0-RC.3 or later.

Exploit

Fix

IDOR

NULL Pointer Dereference

Weakness Enumeration

CWE-639

CWE-476

Related Identifiers

CVE-2026-32894

Affected Products

Chamilo Lms

References · 6

• 🔥 https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-rqpg-p95v-fv98 · Exploit
• https://github.com/chamilo/chamilo-lms/commit/3b03306d1a0301a81b9284e86893b27f518ab151 · Patch
• https://github.com/chamilo/chamilo-lms/commit/740f5a6e192a52a3adde3c3241c86401b1d2c519 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-32894 · Security Note
• https://twitter.com/VulmonFeeds/status/2042784526137520400 · Twitter Post
• https://twitter.com/CVEnew/status/2042710210398036268 · Twitter Post