CVE-2026-32930 is an authorization bypass vulnerability in Chamilo LMS affecting the gradebook evaluation edit page. Authenticated teachers can exploit an Insecure Direct Object Reference (IDOR) by manipulating the 'editeval' GET parameter to access and modify evaluation settings of courses they do not own. This impacts versions prior to 1.11.38 and between 2.0.0-alpha.1 and 2.0.0-RC.3. The vulnerability allows unauthorized disclosure and modification of evaluation data such as name, max score, and weight. The issue is fixed in Chamilo LMS versions 1.11.38 and 2.0.0-RC.3. The CVSS 3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, and requiring low privileges but no user interaction.

An attacker with authenticated teacher privileges can bypass authorization controls to view and modify evaluation settings of other courses. This could lead to unauthorized changes in grading criteria, potentially affecting course assessments and integrity. The confidentiality impact is low, integrity impact is high, and availability is not affected. There are no reports of active exploitation.

Upgrade Chamilo LMS to version 1.11.38 or later, or to 2.0.0-RC.3 or later, where this vulnerability is fixed. Since this is not a cloud service, administrators must apply the patch manually. No other mitigations are indicated by the vendor advisory. Patch status is confirmed fixed in the specified versions.