CVE-2026-114389 Details
Description
Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in AiController::openAnswerGrade that allows any authenticated user to obtain AI grading of other students' exam attempts. Attackers can enumerate exeId and questionId values sent to the open_answer_grade endpoint to expose other students' answers through feedback and consume AI quota.
A missing authorization vulnerability has been identified in Chamilo LMS versions 2.0.0-alpha.4 prior to 2.0.0-RC.3. The vulnerability resides in the AiController's openAnswerGrade method, where it allows any authenticated user to access AI-generated grading for other students' exam attempts. Exploitation involves enumerating exeId and questionId values through the open_answer_grade endpoint, which can reveal other students' answers via feedback and deplete AI usage quotas.
Users can update to Chamilo LMS version 2.0.0-RC.3 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/chamilo/chamilo-lms/blob/v2.0.0-RC.2/src/CoreBundle/Controller/AiController.php#L525-L703 | [email protected] | Source CodeVendor |
| https://github.com/chamilo/chamilo-lms/commit/2861afd4896ff898a950302f2c00f44726fa6f0a | [email protected] | Source CodeVendor |
| https://github.com/chamilo/chamilo-lms/issues/7671 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/chamilo-lms-2.0.0-alpha.4-before-2.0.0-rc.3-missing-authorization-via-openanswergrade | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Chamilo LMS | >= 2.0.0-alpha.4, < 2.0.0-RC.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 21, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |