CVE-2026-32894

HighCVSS 7.1/10Last modified Oct 26, 2026

Description

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the gradebook result view page allows any authenticated teacher to delete any student's grade result across the entire platform by manipulating the delete_mark or resultdelete GET parameters. No ownership or course-scope verification is performed. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Weakness enumeration

CWE-476 CWE-639

Affected software

Vendor	Product	Versions
chamilo	chamilo-lms	< 1.11.38; >= 2.0.0-alpha.1, < 2.0.0-RC.3

References

https://github.com/chamilo/chamilo-lms/commit/3b03306d1a0301a81b9284e86893b27f518ab151Patch
https://github.com/chamilo/chamilo-lms/commit/740f5a6e192a52a3adde3c3241c86401b1d2c519Patch
https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-rqpg-p95v-fv98Exploit, Vendor Advisory
https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-rqpg-p95v-fv98Exploit, Vendor Advisory

Timeline

Published: Apr 10, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-328955.4OpenClaw versions prior to 2026.2.26 fail to enforce sender authorization in member and message subtype system event handlers, allowing unau CVE-2026-328966.5The BlueBubbles webhook handler in OpenClaw versions prior to 2026.2.21 contains a passwordless fallback authentication path that allows una CVE-2026-328975.3OpenClaw versions prior to 2026.2.22 reuse gateway.auth.token as a fallback hash secret for owner-ID prompt obfuscation when commands.ownerD CVE-2026-328985.4OpenClaw versions prior to 2026.2.23 contain an authorization bypass vulnerability in the ACP client that auto-approves tool calls based on CVE-2026-328994.3OpenClaw versions prior to 2026.2.25 fail to consistently apply sender-policy checks to reaction_* and pin_* non-message events before addin CVE-2026-32907.4Timing limitations of the HRNG in RS9116 when power save mode is enabled results in predictable values CVE-2026-329058.3OpenClaw before 2026.5.4 contains an authorization bypass vulnerability in the bundled device-pair plugin that allows non-owner authorized c CVE-2026-329064.3OpenClaw before 2026.5.12 contains a privilege escalation vulnerability in Slack plugin approvals that allows exec-authorized users to resol CVE-2026-32915.5Samsung Print Service Plugin for Android is potentially vulnerable to information disclosure when using an outdated version of the applicati CVE-2026-329139.1OpenClaw before 2026.3.7 contains an improper header validation vulnerability in fetchWithSsrFGuard that forwards custom authorization heade CVE-2026-329148.8OpenClaw before 2026.3.12 contains an insufficient access control vulnerability in the /config and /debug command handlers that allows comma CVE-2026-329158.8OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability allowing leaf subagents to access the subagents control surface a