CVE-2026-3110: Campus Educativa IDOR Vulnerability

CVE-2026-3110 Overview

An Insecure Direct Object Reference (IDOR) vulnerability has been discovered in Campus Educativa, a learning management platform. The vulnerability exists specifically at the endpoint /administracion/admin_usuarios.cgi which is used for exporting user data. By manipulating the wid_cursoActual parameter, an unauthenticated attacker can access sensitive user information including usernames, first and last names, email addresses, and phone numbers of all users enrolled in courses.

Critical Impact

Unauthenticated attackers can enumerate and extract personal data of all enrolled users by brute-forcing course IDs, leading to mass data exposure without any authentication requirements.

Affected Products

• Campus Educativa (all versions with the vulnerable endpoint)

Discovery Timeline

• 2026-03-16 - CVE-2026-3110 published to NVD
• 2026-03-16 - Last updated in NVD database

Technical Details for CVE-2026-3110

Vulnerability Analysis

This vulnerability stems from improper access control (CWE-284) in the Campus Educativa platform. The affected endpoint /administracion/admin_usuarios.cgi is designed to export enrolled user data in XLSX format but fails to implement proper authorization checks. The endpoint accepts several parameters including filtro_estado, wAccion, wBuscar, wFiltrar, wOrden, and critically, wid_cursoActual which identifies the course.

The vulnerability allows attackers to manipulate the wid_cursoActual parameter to reference arbitrary course IDs. Since no authentication or authorization validation occurs before processing the request, any external actor can enumerate course IDs and retrieve associated user data. The attack can be automated to iterate through course ID values sequentially, enabling extraction of the entire user database across all courses.

Root Cause

The root cause of this vulnerability is improper access control implementation. The application fails to verify whether the requesting user has legitimate access to view user data for the specified course. No session validation, authentication check, or authorization verification is performed before returning sensitive user information. This represents a fundamental breakdown in the application's security architecture where administrative functionality is exposed without proper access controls.

Attack Vector

The attack is conducted entirely over the network and requires no authentication or user interaction. An attacker constructs a URL to the vulnerable endpoint with the wAccion=listado_xlsx parameter to trigger the data export functionality. By iterating the wid_cursoActual parameter through a range of values (brute-forcing course IDs), the attacker can systematically download user enrollment data for every course in the system.

The vulnerable URL pattern follows this structure: /administracion/admin_usuarios.cgi?filtro_estado=T&wAccion=listado_xlsx&wBuscar=&wFiltrar=&wOrden=alta_usuario&wid_cursoActual=[ID]. The attacker simply needs to modify the ID value to enumerate through available courses. Since the endpoint returns XLSX files containing user data, the attack can be fully automated using simple HTTP requests and scripting. For detailed technical information, refer to the INCIBE Security Notice.

Detection Methods for CVE-2026-3110

Indicators of Compromise

• Unusual volume of requests to /administracion/admin_usuarios.cgi endpoint, especially with wAccion=listado_xlsx parameter
• Sequential or rapid enumeration patterns in wid_cursoActual parameter values from single IP addresses
• Unauthenticated requests accessing administrative endpoints that should require authentication
• Large numbers of XLSX file exports in access logs from external or unexpected sources

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block rapid sequential requests to the vulnerable endpoint
• Configure rate limiting on the /administracion/admin_usuarios.cgi endpoint to prevent brute-force enumeration
• Monitor access logs for requests containing wAccion=listado_xlsx without valid session authentication
• Set up alerts for abnormal patterns of course ID parameter values indicating enumeration attempts

Monitoring Recommendations

• Enable detailed logging on administrative endpoints including full request parameters and source IP addresses
• Implement anomaly detection for the user export functionality to identify unusual access patterns
• Monitor for geographic anomalies where requests originate from unexpected regions
• Track and alert on failed authentication attempts followed by direct endpoint access

How to Mitigate CVE-2026-3110

Immediate Actions Required

• Restrict access to the /administracion/admin_usuarios.cgi endpoint by implementing IP-based access controls or firewall rules
• Disable the user export functionality (wAccion=listado_xlsx) until a proper fix can be applied
• Review access logs to identify any potential data exfiltration that may have already occurred
• Notify potentially affected users if evidence of exploitation is discovered

Patch Information

For official patch information and remediation guidance, consult the INCIBE Security Notice for details on available updates and vendor recommendations.

Workarounds

• Implement authentication requirements at the web server level for all administrative endpoints using .htaccess or equivalent server configuration
• Deploy a reverse proxy or WAF to enforce authentication before requests reach the Campus Educativa application
• Apply network segmentation to restrict access to administrative functionality to trusted internal networks only
• Configure rate limiting to prevent brute-force enumeration of course IDs

# Example Apache .htaccess configuration to restrict access to administrative endpoints
<LocationMatch "^/administracion/">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
    # Or require valid authentication
    # AuthType Basic
    # AuthName "Restricted Access"
    # AuthUserFile /etc/apache2/.htpasswd
    # Require valid-user
</LocationMatch>