CVE-2026-32930: Chamilo LMS Auth Bypass Vulnerability

CVE-2026-32930 Overview

CVE-2026-32930 is an Insecure Direct Object Reference (IDOR) vulnerability discovered in Chamilo LMS, an open-source learning management system. The vulnerability exists in the gradebook evaluation edit page, where any authenticated teacher can view and modify evaluation settings (name, max score, weight) belonging to any other course by manipulating the editeval GET parameter. This authorization bypass allows horizontal privilege escalation across course boundaries, potentially compromising the integrity of academic grading systems.

Critical Impact

Authenticated teachers can access and modify gradebook evaluations belonging to other courses, enabling unauthorized manipulation of grading parameters and academic records across the entire LMS platform.

Affected Products

• Chamilo LMS versions prior to 1.11.38
• Chamilo LMS versions prior to 2.0.0-RC.3

Discovery Timeline

• April 10, 2026 - CVE-2026-32930 published to NVD
• April 13, 2026 - Last updated in NVD database

Technical Details for CVE-2026-32930

Vulnerability Analysis

The vulnerability stems from insufficient authorization checks in the gradebook evaluation edit functionality. When processing evaluation edit requests, the application failed to verify whether the requesting user had legitimate access to the specific evaluation being modified. The flawed logic only checked if an evaluation was locked and if the user was not a platform administrator, without validating course ownership.

Prior to the patch, the code path in gradebook_edit_eval.php would load an evaluation object based entirely on the user-supplied editeval GET parameter without verifying that the evaluation belonged to the current course context. This allowed any authenticated teacher to enumerate and access evaluations across the entire platform by incrementing or guessing evaluation IDs.

Root Cause

The root cause is classified as CWE-639: Authorization Bypass Through User-Controlled Key. The application trusted user-supplied input (the editeval parameter) to identify resources without performing adequate authorization checks to ensure the requesting user had permission to access those resources. The original code lacked course context validation, allowing cross-course access to evaluation objects.

Attack Vector

The attack can be executed remotely over the network by any authenticated user with teacher privileges. An attacker would navigate to the gradebook evaluation edit page and manipulate the editeval GET parameter to reference evaluations from other courses. For example, incrementing the evaluation ID in the URL allows enumeration and access to evaluations the attacker should not be able to view or modify.

The attack requires low complexity—no special conditions or timing are needed. Once exploited, attackers can read sensitive evaluation settings and modify critical grading parameters such as evaluation names, maximum scores, and weight values, directly impacting academic integrity.

// Vulnerable code - Original implementation (before patch)
// Source: https://github.com/chamilo/chamilo-lms/commit/63e1e6d3d717bd537c7c61719416da35aaa658dd

GradebookUtils::block_students();

$evaledit = Evaluation::load($_GET['editeval']);
if ($evaledit[0]->is_locked() && !api_is_platform_admin()) {
    api_not_allowed();
}

// Patched code - Security fix adding course ownership validation
// Source: https://github.com/chamilo/chamilo-lms/commit/63e1e6d3d717bd537c7c61719416da35aaa658dd

GradebookUtils::block_students();

$evaledit = Evaluation::load($_GET['editeval']);
if (empty($evaledit[0])) {
    api_not_allowed(true);
}
if (!api_is_platform_admin()) {
    $currentCourseCode = api_get_course_id();

    if ($evaledit[0]->get_course_code() && $evaledit[0]->get_course_code() != $currentCourseCode) {
        api_not_allowed(true);
    }

    if ($evaledit[0]->is_locked()) {
        api_not_allowed(true);
    }
}

Detection Methods for CVE-2026-32930

Indicators of Compromise

• Unusual access patterns to /main/gradebook/gradebook_edit_eval.php with varying editeval parameter values from single sessions
• Sequential or enumerated editeval parameter values in web server access logs indicating ID enumeration attempts
• Teachers accessing or modifying evaluations outside their assigned courses, detectable through application audit logs
• Unexpected changes to evaluation settings (name, max score, weight) without corresponding legitimate administrative actions

Detection Strategies

• Implement web application firewall (WAF) rules to detect parameter tampering and sequential ID enumeration patterns
• Monitor application logs for access attempts to gradebook_edit_eval.php where the requesting user's course context doesn't match the evaluation's course
• Configure alerting for multiple rapid requests to the gradebook edit endpoint with different evaluation IDs from the same user session
• Review database modification timestamps on evaluation records and correlate with user activity logs

Monitoring Recommendations

• Enable detailed access logging for all gradebook-related endpoints including the editeval parameter values
• Implement anomaly detection for teachers accessing resources outside their normal course assignments
• Set up real-time alerts for bulk modifications to evaluation settings across multiple courses
• Regularly audit evaluation change history and compare against authorized user course assignments

How to Mitigate CVE-2026-32930

Immediate Actions Required

• Upgrade Chamilo LMS to version 1.11.38 or later for the 1.x branch
• Upgrade Chamilo LMS to version 2.0.0-RC.3 or later for the 2.x branch
• Review audit logs for any unauthorized evaluation access or modifications prior to patching
• Consider temporarily restricting access to the gradebook edit functionality until patches are applied

Patch Information

Chamilo has released security patches addressing this vulnerability. The fix adds proper course ownership validation before allowing evaluation edits. For version 1.x installations, the patch is included in release 1.11.38. For version 2.x installations, the patch is available in 2.0.0-RC.3.

Detailed patch information is available through the GitHub Security Advisory (GHSA-9h22-wrg7-82q6).

The commits implementing the fix:

• Commit for 1.x branch
• Commit for 2.x branch

Workarounds

• If immediate patching is not possible, restrict access to the gradebook evaluation edit page at the web server level using authentication controls
• Implement additional authorization middleware to validate course membership before processing gradebook requests
• Monitor and alert on any gradebook edit attempts and manually review for unauthorized cross-course access
• Consider temporarily disabling the gradebook edit functionality for non-administrator users until the patch can be applied

# Apache configuration example - restrict gradebook edit access
<Location /main/gradebook/gradebook_edit_eval.php>
    # Restrict to specific IP ranges or require additional authentication
    Require ip 192.168.1.0/24
    # Or implement additional authentication layer
</Location>