CVE-2026-32930 Chamilo — Exploit & Vulnerability Details HIGH

Parameter	Value
CVSS	7.1 (HIGH)
Affected Versions	before 1.11.38
Fixed In	1.11.38
Type	CWE-639 (Authorization Bypass)
Vendor	Chamilo
Public PoC	No

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the gradebook evaluation edit page allows any authenticated teacher to view and modify the settings (name, max score, weight) of evaluations belonging to any other course by manipulating the editeval GET parameter. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

Attack Parameters

Attack Vector

Network

Can be exploited remotely

Attack Complexity

Low

Easy to exploit

Privileges Required

Low

Basic privileges needed

User Interaction

None

No user interaction needed

Impact Assessment

Confidentiality

Low

Partial data leak

Integrity

High

Complete data modification

Availability

None

No disruption

CVSS Vector v3.1

Weakness Type (CWE)

CWE-639 Authorization Bypass

Vulnerable Products 11

Configuration	From (including)	Up to (excluding)
Chamilo Chamilo_Lms cpe:2.3:a:chamilo:chamilo_lms::::::::	—	`1.11.38`
Chamilo Chamilo_Lms cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha1::::::	—	—
Chamilo Chamilo_Lms cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha2::::::	—	—
Chamilo Chamilo_Lms cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha3::::::	—	—
Chamilo Chamilo_Lms cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha4::::::	—	—
Chamilo Chamilo_Lms cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha5::::::	—	—
Chamilo Chamilo_Lms cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta1::::::	—	—
Chamilo Chamilo_Lms cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta2::::::	—	—
Chamilo Chamilo_Lms cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta3::::::	—	—
Chamilo Chamilo_Lms cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc1::::::	—	—
Chamilo Chamilo_Lms cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc2::::::	—	—