What is the CVSS score of CVE-2026-32894?

CVE-2026-32894 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Chamilo Lms are affected by CVE-2026-32894?

Chamilo LMS versions prior to 1.11.38 and 2.0.0-RC.3 contain an authentication bypass vulnerability allowing authenticated teachers to permanently delete student grades across any course through…. A patch is available.

How to fix or mitigate CVE-2026-32894?

Within 24 hours: Identify all Chamilo LMS instances and document current versions in use. Within 7 days: upgrade to Chamilo LMS 1.11.38 or 2.0.0-RC.3 or later, and review access logs for suspicious gradebook delete operations (filter for delete_mark or resultdelete parameters). Within 30 days: audit all grade modifications from the past 90 days, restore any unauthorized deletions from backups, and implement role-based access controls limiting teacher grade deletion rights to their own courses only.

Chamilo Lms CVE-2026-32894

EUVD-2026-21527 HIGH

NULL Pointer Dereference (CWE-476)

2026-04-10 GitHub_M

Denial Of Service Null Pointer Dereference Chamilo Lms

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 21:37 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:58 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.11.38,2.0.0-RC.3

EUVD ID Assigned

Apr 10, 2026 - 18:00 euvd

EUVD-2026-21527

Analysis Generated

Apr 10, 2026 - 18:00 vuln.today

CVE Published

Apr 10, 2026 - 17:44 nvd

HIGH 7.1

DescriptionGitHub Advisory

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the gradebook result view page allows any authenticated teacher to delete any student's grade result across the entire platform by manipulating the delete_mark or resultdelete GET parameters. No ownership or course-scope verification is performed. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

AnalysisAI

Authenticated teachers in Chamilo LMS can delete arbitrary student grades platform-wide through Insecure Direct Object Reference in gradebook result views. By manipulating delete_mark or resultdelete GET parameters, attackers bypass course-scope and ownership controls, enabling unauthorized grade deletion across all courses. Versions prior to 1.11.38 and 2.0.0-RC.3 lack server-side validation. No public exploit identified at time of analysis. CVSS 7.1 (High) reflects authenticated access requirement with high integrity impact and low availability impact.

Technical ContextAI

CWE-476 (Null Pointer Dereference) misclassifies root cause-actual mechanism is IDOR via unvalidated GET parameters in gradebook deletion endpoints. Missing authorization checks allow privilege escalation within teacher role, permitting cross-course data manipulation. Authentication required (PR:L) but no course-level RBAC enforcement enables platform-wide grade tampering through direct parameter injection.

RemediationAI

Vendor-released patch: upgrade to Chamilo LMS 1.11.38 (stable branch) or 2.0.0-RC.3 (development branch). Upstream fixes implement authorization validation in commits 3b03306d1a0301a81b9284e86893b27f518ab151 and 740f5a6e192a52a3adde3c3241c86401b1d2c519. Organizations unable to immediately upgrade should restrict teacher account creation, audit gradebook modification logs, and implement web application firewall rules blocking unauthorized delete_mark/resultdelete parameter access. Review user roles to ensure least-privilege access. Official advisory: https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-rqpg-p95v-fv98