PT-2026-32003 · Chamilo · Chamilo Lms

Published 2026-04-10 · Updated 2026-04-10 · CVE-2026-32894

NVD

CVSS v3.1

7.1

High

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the gradebook result view page allows any authenticated teacher to delete any student's grade result across the entire platform by manipulating the delete mark or resultdelete GET parameters. No ownership or course-scope verification is performed. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

Fix

NULL Pointer Dereference

IDOR

Weakness Enumeration

CWE-476

CWE-639

Related Identifiers

CVE-2026-32894

Affected Products

Chamilo Lms

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-32894 · Security Note
• https://github.com/chamilo/chamilo-lms/commit/740f5a6e192a52a3adde3c3241c86401b1d2c519 · Note
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-rqpg-p95v-fv98 · Note
• https://github.com/chamilo/chamilo-lms/commit/3b03306d1a0301a81b9284e86893b27f518ab151 · Note