CVE-2026-32894: CWE-476: NULL Pointer Dereference in chamilo chamilo-lms
Chamilo LMS versions prior to 1. 11. 38 and 2. 0. 0-RC. 3 contain an Insecure Direct Object Reference (IDOR) vulnerability in the gradebook result view page. This flaw allows any authenticated teacher to delete any student's grade result across the platform by manipulating specific GET parameters without ownership or course-scope verification. The vulnerability is identified as CWE-476 (NULL Pointer Dereference) and CWE-639. It has a CVSS 3. 1 score of 7.
AI Analysis
Technical Summary
Chamilo LMS suffers from an IDOR vulnerability allowing authenticated teachers to delete any student's grade results by manipulating the delete_mark or resultdelete GET parameters. The vulnerability arises due to lack of ownership or course-scope verification and is classified under CWE-476 and CWE-639. It affects versions prior to 1.11.38 and 2.0.0-RC.3. The vulnerability has a CVSS 3.1 score of 7.1, reflecting high impact on integrity with low attack complexity and requiring privileges of an authenticated teacher. The issue is resolved in Chamilo LMS versions 1.11.38 and 2.0.0-RC.3.
Potential Impact
An authenticated teacher can delete any student's grade result across the entire Chamilo LMS platform regardless of course ownership or scope. This compromises data integrity by allowing unauthorized modification of student grades. There is no reported impact on confidentiality or availability beyond a low impact on availability. No known exploits in the wild have been reported.
Mitigation Recommendations
Upgrade Chamilo LMS to version 1.11.38 or later, or to 2.0.0-RC.3 or later, where this vulnerability is fixed. Since the vendor advisory confirms the fix in these versions, applying the official update is the recommended remediation. Patch status is not explicitly stated beyond the fixed versions, so verify with the vendor for the latest guidance. No additional mitigation steps are indicated.
CVE-2026-32894: CWE-476: NULL Pointer Dereference in chamilo chamilo-lms
Description
Chamilo LMS versions prior to 1. 11. 38 and 2. 0. 0-RC. 3 contain an Insecure Direct Object Reference (IDOR) vulnerability in the gradebook result view page. This flaw allows any authenticated teacher to delete any student's grade result across the platform by manipulating specific GET parameters without ownership or course-scope verification. The vulnerability is identified as CWE-476 (NULL Pointer Dereference) and CWE-639. It has a CVSS 3. 1 score of 7.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Chamilo LMS suffers from an IDOR vulnerability allowing authenticated teachers to delete any student's grade results by manipulating the delete_mark or resultdelete GET parameters. The vulnerability arises due to lack of ownership or course-scope verification and is classified under CWE-476 and CWE-639. It affects versions prior to 1.11.38 and 2.0.0-RC.3. The vulnerability has a CVSS 3.1 score of 7.1, reflecting high impact on integrity with low attack complexity and requiring privileges of an authenticated teacher. The issue is resolved in Chamilo LMS versions 1.11.38 and 2.0.0-RC.3.
Potential Impact
An authenticated teacher can delete any student's grade result across the entire Chamilo LMS platform regardless of course ownership or scope. This compromises data integrity by allowing unauthorized modification of student grades. There is no reported impact on confidentiality or availability beyond a low impact on availability. No known exploits in the wild have been reported.
Mitigation Recommendations
Upgrade Chamilo LMS to version 1.11.38 or later, or to 2.0.0-RC.3 or later, where this vulnerability is fixed. Since the vendor advisory confirms the fix in these versions, applying the official update is the recommended remediation. Patch status is not explicitly stated beyond the fixed versions, so verify with the vendor for the latest guidance. No additional mitigation steps are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-03-16T21:03:44.422Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d938791cc7ad14dad95287
Added to database: 4/10/2026, 5:50:49 PM
Last enriched: 4/10/2026, 6:06:08 PM
Last updated: 4/11/2026, 12:58:04 AM
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.