CVE-2026-32932 is an Open Redirect vulnerability (CWE-601) in Chamilo LMS affecting versions prior to 1.11.38 and from 2.0.0-alpha.1 up to but not including 2.0.0-RC.3. The vulnerability occurs on the session course edit page, where after an authenticated administrator saves coach assignment changes, the application redirects to an attacker-controlled external URL. This redirect also exposes the id_session parameter to the attacker. The vulnerability has been addressed and fixed in Chamilo LMS versions 1.11.38 and 2.0.0-RC.3.

An attacker can exploit this vulnerability to redirect authenticated administrators to malicious external websites, potentially facilitating phishing or social engineering attacks. The leakage of the id_session parameter to the attacker could aid in session-related reconnaissance or targeted attacks. However, there is no indication of direct compromise of confidentiality, integrity, or availability beyond the redirect and parameter leakage.

This vulnerability is fixed in Chamilo LMS versions 1.11.38 and 2.0.0-RC.3. Users should upgrade to these or later versions to remediate the issue. No official patch links or temporary mitigations are provided in the advisory. Patch status is not explicitly confirmed beyond the version fix information, so users should verify with the vendor for the latest remediation guidance.