PT-2026-32003 · Unknown · Chamilo Lms

CVE-2026-32894 · Published 2026-04-10 · Updated 2026-04-11

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions prior to 1.11.38 Chamilo LMS versions prior to 2.0.0-RC.3

Description Chamilo LMS contains an Insecure Direct Object Reference (IDOR) issue in the gradebook result view page. An authenticated teacher can delete any student's grade result by manipulating the delete mark or resultdelete GET parameters. There is no ownership or course-scope verification performed.

Recommendations Update to version 1.11.38 or later. Update to version 2.0.0-RC.3 or later.

Exploit

Fix

NULL Pointer Dereference

IDOR

Weakness Enumeration

CWE-476

CWE-639

Related Identifiers

CVE-2026-32894

GHSA-RQPG-P95V-FV98

Affected Products

Chamilo Lms

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32894.json · Exploit
• 🔥 https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-rqpg-p95v-fv98 · Exploit
• https://github.com/chamilo/chamilo-lms/commit/740f5a6e192a52a3adde3c3241c86401b1d2c519 · Patch
• https://github.com/chamilo/chamilo-lms/commit/3b03306d1a0301a81b9284e86893b27f518ab151 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-32894 · Security Note
• https://osv.dev/vulnerability/CVE-2026-32894 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2042784526137520400 · Twitter Post
• https://twitter.com/CVEnew/status/2042710210398036268 · Twitter Post