Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the gradebook evaluation edit page allows any authenticated teacher to view and modify the settings (name, max score, weight) of evaluations belonging to any other course by manipulating the editeval GET parameter. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.
References
Configurations
Configuration 1 (hide)
|
History
17 Apr 2026, 21:28
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha2:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha3:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha1:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha5:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha4:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta1:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta2:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc1:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc2:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta3:*:*:*:*:*:* |
|
| First Time |
Chamilo chamilo Lms
Chamilo |
|
| References | () https://github.com/chamilo/chamilo-lms/commit/63e1e6d3d717bd537c7c61719416da35aaa658dd - Patch | |
| References | () https://github.com/chamilo/chamilo-lms/commit/f03f681df939db0429edc8414fb3ce4e4b80d79d - Patch | |
| References | () https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-9h22-wrg7-82q6 - Vendor Advisory |
10 Apr 2026, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-10 18:16
Updated : 2026-04-17 21:28
NVD link : CVE-2026-32930
Mitre link : CVE-2026-32930
CVE.ORG link : CVE-2026-32930
JSON object : View
Products Affected
chamilo
- chamilo_lms
CWE
CWE-639
Authorization Bypass Through User-Controlled Key