PT-2026-32011 · Chamilo · Chamilo Lms

Published 2026-04-10 · Updated 2026-04-10 · CVE-2026-32932

Mitre

CVSS v3.1

4.7

Medium

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Open Redirect vulnerability in the session course edit page allows an attacker to redirect an authenticated administrator to an arbitrary external URL after saving coach assignment changes. The redirect also leaks the id session parameter to the attacker's server. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-32932

Affected Products

Chamilo Lms

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-32932 · Security Note
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-q2cp-3qj3-wx8q · Note
• https://github.com/chamilo/chamilo-lms/commit/fbd8d7eb37d05ec974293f05b6ffaaf9102ebd2b · Note
• https://github.com/chamilo/chamilo-lms/commit/b005b3d3e76cf6eafc03e15ac445ceff089551c0 · Note