CVE-2026-32894

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-32894

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32894.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-32894

Aliases

GHSA-rqpg-p95v-fv98

Published

2026-04-10T17:44:24.994Z

Modified

2026-07-08T08:11:16.100508771Z

Severity

7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L CVSS Calculator

Summary

Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Deletion of Any Student's Grade Result

Details

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the gradebook result view page allows any authenticated teacher to delete any student's grade result across the entire platform by manipulating the delete_mark or resultdelete GET parameters. No ownership or course-scope verification is performed. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32894.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-476",
        "CWE-639"
    ]
}

References

Affected packages

Git / github.com/chamilo/chamilo-lms

Affected ranges

Type

GIT

Repo

https://github.com/chamilo/chamilo-lms

Events

Introduced

Fixed

abb5547a46a96339dfe6079e9b7ecd329bca181a

Fixed

3b03306d1a0301a81b9284e86893b27f518ab151

Fixed

740f5a6e192a52a3adde3c3241c86401b1d2c519

Database specific

{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.11.38"
        }
    ]
}

Affected versions

Other

CHAMILO_1_8_7_ALPHA_1

CHAMILO_1_8_7_ALPHA_2

CHAMILO_1_8_7_RC2

CHAMILO_1_8_7_RC_1

CHAMILO_1_8_7_STABLE

CHAMILO_1_8_7_STABLE_BIS

CHAMILO_1_8_8_2_RC_1

CHAMILO_1_8_8_2_STABLE

CHAMILO_1_8_8_2_STABLE_2

CHAMILO_1_8_8_4_STABLE

CHAMILO_1_8_8_ALPHA

CHAMILO_1_8_8_BETA_1

CHAMILO_1_8_8_BETA_2

CHAMILO_1_9_0_ALPHA_1

CHAMILO_1_9_0_ALPHA_2

CHAMILO_1_9_0_ALPHA_4

CHAMILO_1_9_0_PRE_ALPHA

CHAMILO_1_9_0_RC_1

CHAMILO_1_9_0_STABLE_2

CHAMILO_1_9_0_STABLE_3

CHAMILO_1_9_2_STABLE

CHAMILO_1_9_2_STABLE_QUARTER

CHAMILO_1_9_4_ALPHA_1

CHAMILO_1_9_4_RC_1

CHAMILO_1_9_4_STABLE

CHAMILO_1_9_6_RC_1

CHAMILO_1_9_6_RC_2

CHAMILO_1_9_6_STABLE

CHAMILO_1_8_8.*

CHAMILO_1_8_8.3_STABLE_4

v1.*

v1.11.10

v1.11.12

v1.11.14

v1.11.14-beta.1

v1.11.18

v1.11.20

v1.11.20-beta.1

v1.11.22

v1.11.22-beta.1

v1.11.22-beta.2

v1.11.24

v1.11.26

v1.11.26-rc.1

v1.11.28

v1.11.30

v1.11.30-rc.1

v1.11.32

v1.11.36

v1.11.6

v1.11.6-alpha.1

v1.8.6.1

v1.9.8

v2.*

v2.0.0-RC.1

v2.0.0-RC.2

v2.0.0-alpha.1

v2.0.0-alpha.2

v2.0.0-alpha.3

v2.0.0-alpha.4

v2.0.0-alpha.5

v2.0.0-beta.1

v2.0.0-beta.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32894.json"