What is the CVSS score of CVE-2026-32930?

CVE-2026-32930 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Chamilo Lms are affected by CVE-2026-32930?

Chamilo LMS versions before 1.11.38 and 2.0.0-RC.3 contain an authentication bypass flaw that allows authenticated teachers to manipulate gradebook settings and evaluation criteria in courses outside…. A patch is available.

How to fix or mitigate CVE-2026-32930?

Within 24 hours: Identify all Chamilo LMS instances in your environment and document current versions. Within 7 days: Apply vendor patches to upgrade Chamilo to version 1.11.38 or 2.0.0-RC.3 or later; prioritize production systems first. Within 30 days: Conduct audit of gradebook modification logs for the past 90 days to identify unauthorized changes; review role-based access controls for teacher accounts and implement principle of least privilege.

Chamilo Lms CVE-2026-32930

EUVD-2026-21529 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-10 security-advisories@github.com

Authentication Bypass Chamilo Lms

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 21:37 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:58 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2.0.0-RC.3,1.11.38

EUVD ID Assigned

Apr 10, 2026 - 18:22 euvd

EUVD-2026-21529

Analysis Generated

Apr 10, 2026 - 18:22 vuln.today

CVE Published

Apr 10, 2026 - 18:16 nvd

HIGH 7.1

DescriptionGitHub Advisory

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the gradebook evaluation edit page allows any authenticated teacher to view and modify the settings (name, max score, weight) of evaluations belonging to any other course by manipulating the editeval GET parameter. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

AnalysisAI

Authenticated teachers in Chamilo LMS versions prior to 1.11.38 and 2.0.0-RC.3 can access and modify gradebook evaluation settings across unauthorized courses through Insecure Direct Object Reference in the editeval parameter. Attackers with low-privilege teacher accounts can alter evaluation names, maximum scores, and weights for assessments in courses they do not own, enabling unauthorized data disclosure and integrity compromise. No public exploit identified at time of analysis.

Technical ContextAI

CWE-639 Authorization Bypass Through User-Controlled Key flaw in gradebook evaluation edit functionality. Server-side fails to validate course ownership before processing editeval GET parameter, allowing horizontal privilege escalation. Authenticated teacher role (PR:L) required; network-accessible attack vector (AV:N) with no complexity barriers (AC:L) enables cross-course data manipulation without UI interaction.

RemediationAI

Vendor-released patch: upgrade to Chamilo LMS 1.11.38 for 1.x deployments or 2.0.0-RC.3 for 2.x pre-release environments. Upstream fixes implemented in commits 63e1e6d3d717bd537c7c61719416da35aaa658dd and f03f681df939db0429edc8414fb3ce4e4b80d79d add server-side authorization checks validating teacher-course association before gradebook evaluation modification. Official advisory: https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-9h22-wrg7-82q6. No effective workarounds exist short of disabling gradebook functionality; immediate upgrade strongly recommended. Restrict teacher account provisioning and audit existing role assignments during patch deployment window to limit exposure surface.