CVE-2026-32894 Chamilo — Exploit & Vulnerability Details HIGH

Parameter	Value
CVSS	7.1 (HIGH)
Affected Versions	before 1.11.38
Fixed In	1.11.38
Type	CWE-476 (NULL Pointer Dereference), CWE-639 (Authorization Bypass)
Vendor	Chamilo
Public PoC	No

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the gradebook result view page allows any authenticated teacher to delete any student's grade result across the entire platform by manipulating the delete_mark or resultdelete GET parameters. No ownership or course-scope verification is performed.

This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

Attack Parameters

Attack Vector

Network

Can be exploited remotely

Attack Complexity

Low

Easy to exploit

Privileges Required

Low

Basic privileges needed

User Interaction

None

No user interaction needed

Impact Assessment

Confidentiality

None

No data leak

Integrity

High

Complete data modification

Availability

Low

Partial disruption

CVSS Vector v3.1

Weakness Type (CWE)

CWE-476 NULL Pointer Dereference

CWE-639 Authorization Bypass

Vulnerable Products 11

Configuration	From (including)	Up to (excluding)
Chamilo Chamilo_Lms cpe:2.3:a:chamilo:chamilo_lms::::::::	—	`1.11.38`
Chamilo Chamilo_Lms cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha1::::::	—	—
Chamilo Chamilo_Lms cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha2::::::	—	—
Chamilo Chamilo_Lms cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha3::::::	—	—
Chamilo Chamilo_Lms cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha4::::::	—	—
Chamilo Chamilo_Lms cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha5::::::	—	—
Chamilo Chamilo_Lms cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta1::::::	—	—
Chamilo Chamilo_Lms cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta2::::::	—	—
Chamilo Chamilo_Lms cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta3::::::	—	—
Chamilo Chamilo_Lms cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc1::::::	—	—
Chamilo Chamilo_Lms cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc2::::::	—	—