CVE-2026-114388: Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization via GradebookController
Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in GradebookController that allows unauthenticated users to modify gradebook certificates. Attackers can request the setdefaultcertificate endpoint with any course id and document id to tamper with certificate configuration for any course.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Chamilo LMSto a version that resolves this vulnerability.Fixed in 2.0.0-RC.3
Event History
Frequently Asked Questions
Which deployments are affected?
Chamilo LMS 2.0.0 pre-release versions from 2.0.0-alpha.1 up to, but not including, 2.0.0-RC.3 are affected. The issue is in GradebookController.
Does an attacker need an account or user interaction?
No. The vulnerability can be exploited remotely without authentication or user interaction.
What access does an attacker need to modify certificate settings?
An attacker can request the set_default_certificate endpoint with any course ID and document ID. This permits tampering with the gradebook certificate configuration for any course.
What is the remediation?
Upgrade to Chamilo LMS 2.0.0-RC.3 or later, as the affected range ends before 2.0.0-RC.3.