CVE-2026-114389: Chamilo LMS 2.0.0-alpha.4 before 2.0.0-RC.3 Missing Authorization via openAnswerGrade
Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in AiController::openAnswerGrade that allows any authenticated user to obtain AI grading of other students' exam attempts. Attackers can enumerate exeId and questionId values sent to the openanswergrade endpoint to expose other students' answers through feedback and consume AI quota.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Chamilo LMS versions from 2.0.0-alpha.4 up to, but not including, 2.0.0-RC.3 are affected.
What access does an attacker need?
An attacker needs any authenticated Chamilo account. No additional privileges or user interaction are required.
What information can be exposed?
An attacker can enumerate exeId and questionId values sent to the open_answer_grade endpoint to obtain AI-generated feedback that exposes other students' exam answers. The activity can also consume the application's AI quota.
What is the available remediation?
Upgrade Chamilo LMS to 2.0.0-RC.3 or later, which includes the referenced fix for the authorization issue.