Chamilo LMS CVE-2026-114388

No authentication, user interaction, or special configuration is required: the CVSS vector (AV:N/PR:N/UI:N/AC:L) and the patch confirm the set_default_certificate path in GradebookController had no access control, so any remote unauthenticated user can invoke it against a default deployment. The exploitation is CONSTRAINED to Chamilo LMS 2.0.0 pre-release builds specifically - versions 2.0.0-alpha.1 through 2.0.0-RC.2; stable releases and the fixed 2.0.0-RC.3 are not affected. The practical limiting factor is therefore version/deployment: the instance must be an unpatched 2.0.0 pre-release that is network-reachable, which sharply narrows the realistic target population.

This is a genuine but moderate-severity issue, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a network-reachable, low-complexity, unauthenticated flaw requiring no user interaction, which is why it scores 6.9 (Medium) despite being unauthenticated - the impact is deliberately narrow: VI:L (low integrity impact) with VC:N and VA:N, meaning no data disclosure and no denial of service, only limited tampering with gradebook certificate configuration. No EPSS score was provided in the input, the vulnerability is NOT on the CISA KEV list, and no public exploit code was referenced, so exploitation signals are absent. A patch is confirmed available from the vendor and the issue was reported by VulnCheck (a credible research source), and the GitHub commit diff concretely confirms the root cause (authorization checks added to GradebookController and related AJAX endpoints). The limiting factor on real-world risk is twofold: the impact is confined to certificate configuration tampering (integrity-only, no RCE or data theft), and the affected versions are 2.0.0 pre-releases (alpha.1 through RC.2) that are unlikely to be running in production. Net assessment: legitimate, easily exploitable logic flaw, but low-to-moderate priority given constrained impact and pre-release-only exposure.

An attacker locates an internet-facing Chamilo LMS 2.0.0 pre-release instance and, without any credentials, sends an HTTP request to the set_default_certificate endpoint supplying an arbitrary course id and document id. Because GradebookController lacked an authorization check, the request succeeds and reassigns the default certificate configuration for a course the attacker has no rights to, undermining the integrity of issued certificates. No public proof-of-concept was referenced, but the single-request, no-auth nature makes exploitation trivial to reproduce.