Which versions of Campus are affected by EUVD-2026-12378?

An unauthenticated vulnerability in Campus Educativa exposes sensitive student data (names, emails, phone numbers) to unauthorized access through simple URL manipulation.. A patch is available.

How to fix or mitigate EUVD-2026-12378?

Within 24 hours: Identify all Campus Educativa instances in your environment and assess current user population exposure. Within 7 days: Apply the available vendor patch to all affected systems and verify patch deployment through security scanning. Within 30 days: Conduct a security audit to confirm no unauthorized data access occurred, notify affected students if breach is suspected, and review related IDOR vulnerabilities in Campus Educativa.

Campus EUVD-2026-12378

Q: What is the CVSS score of EUVD-2026-12378?

EUVD-2026-12378 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-3110 HIGH

Improper Access Control (CWE-284)

2026-03-16 INCIBE

Authentication Bypass Campus

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 11:00 euvd

EUVD-2026-12378

Analysis Generated

Mar 16, 2026 - 11:00 vuln.today

Patch released

Mar 16, 2026 - 11:00 nvd

Patch available

CVE Published

Mar 16, 2026 - 09:36 nvd

HIGH 8.7

DescriptionCVE.org

Insecure Direct Object Reference (IDOR) vulnerability in Campus Educativa specifically at the endpoint '/administracion/admin_usuarios.cgi?filtro_estado=T&wAccion=listado_xlsx&wBuscar=&wFiltrar=&wOrden=alta_usuario&wid_cursoActual=[ID]' where the data of users enrolled in the course is exported. Successful exploitation of this vulnerability could allow an unauthenticated attacker to access user data (e.g., usernames, first and last names, email addresses, and phone numbers) and retrieve the data of all users enrolled in courses by performing a brute-force attack on the course ID via a manipulated URL.

AnalysisAI

An Insecure Direct Object Reference (IDOR) vulnerability in Campus Educativa allows unauthenticated attackers to access sensitive user data including usernames, full names, email addresses, and phone numbers of all enrolled students by manipulating course IDs in the export endpoint. The vulnerability requires no authentication and can be exploited remotely through simple URL manipulation and brute-force attacks on course IDs. With a CVSS score of 8.7 and network-based attack vector, this represents a critical data exposure risk for educational institutions using Campus Educativa.

Technical ContextAI

The vulnerability exists in the Campus Educativa learning management system at the administrative export endpoint '/administracion/admin_usuarios.cgi?filtro_estado=T&wAccion=listado_xlsx&wBuscar=&wFiltrar=&wOrden=alta_usuario&wid_cursoActual=[ID]' which generates Excel exports of enrolled user data. The root cause is improper access control (CWE-284) where the application fails to verify whether the requesting user has authorization to access data for the specified course ID parameter. By incrementing or iterating through the wid_cursoActual parameter value, attackers can systematically harvest user data across all courses in the system without any authentication checks.

RemediationAI

Immediate remediation requires implementing proper access controls on the admin_usuarios.cgi endpoint to verify user authentication and authorization before processing export requests. Until a vendor patch is available, administrators should restrict access to the /administracion/ path at the web server or WAF level to only authorized administrative IP addresses or networks. Consider disabling the Excel export functionality if not critical to operations. Monitor access logs for sequential course ID requests that may indicate exploitation attempts. Contact Campus Educativa support for emergency patch availability and implement the fix as soon as released.