CVE-2026-114388

Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in GradebookController that allows unauthenticated users to modify gradebook certificates. Attackers can request the setdefaultcertificate endpoint with any course id and document id...

CVE-2026-114388

The Chamilo LMS software (versions 2.0.0-alpha.1 before 2.0.0-RC.3 ) contains a missing authorization vulnerability within the GradebookController . This flaw allows unauthenticated users to modify gradebook certificates by requesting the set_default_certificate endpoint using arbitrary course an...

CVE-2026-114388 Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization via GradebookController

Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in GradebookController that allows unauthenticated users to modify gradebook certificates. Attackers can request the setdefaultcertificate endpoint with any course id and document id...

EUVD-2026-107235

Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in GradebookController that allows unauthenticated users to modify gradebook certificates. Attackers can request the setdefaultcertificate endpoint with any course id and document id...

PT-2026-120575

Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in GradebookController that allows unauthenticated users to modify gradebook certificates. Attackers can request the set default certificate endpoint with any course id and document ...