CVE-2026-114388 in LMS
Summary
by MITRE • 10/21/2026
Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in GradebookController that allows unauthenticated users to modify gradebook certificates. Attackers can request the set_default_certificate endpoint with any course id and document id to tamper with certificate configuration for any course.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The Chamilo Learning Management System, specifically within its 2.0.0 pre-release versions ranging from alpha.1 up to but not including RC.3, suffers from a critical missing access control vulnerability located in the GradebookController component. This flaw represents a fundamental failure in server-side authorization logic, where the application fails to verify that the requesting user possesses the necessary privileges or ownership rights before processing sensitive administrative requests. In secure software architecture, operations that modify system-wide configurations or persistent data structures must be strictly gated behind robust authentication and authorization checks. The absence of these controls allows any entity with network connectivity to interact directly with internal API endpoints without proving their identity or role within the educational institution's hierarchy.
The technical manifestation of this vulnerability centers on the set_default_certificate endpoint, which is designed to assign a specific document as the default certificate template for a given course. Under normal operational conditions, only authorized instructors, administrators, or system managers should be permitted to alter these settings to ensure academic integrity and proper branding. However, due to the missing access control mechanism, an unauthenticated attacker can craft HTTP requests containing arbitrary course identifiers and document identifiers. By supplying any valid course id alongside a target document id, the attacker forces the server to update its internal state, effectively hijacking the certificate generation process for that specific course. This bypasses all intended security boundaries because the controller does not validate whether the requester is associated with the specified course or holds administrative rights over it.
The operational impact of this vulnerability is significant and multifaceted, primarily affecting the integrity and trustworthiness of academic credentials issued by the platform. An attacker can replace legitimate certificates with malicious documents that may contain phishing links, malware payloads disguised as PDFs, or fraudulent content designed to deceive students and employers. This capability undermines the core value proposition of a Learning Management System, which is to provide verifiable proof of completion for educational courses. Furthermore, this vulnerability facilitates broader attacks such as defacement, reputation damage for the institution using Chamilo, and potential data exfiltration if the malicious documents are configured to send user information back to an external server upon download or viewing.
From a classification perspective, this issue aligns with CWE-284, which describes Improper Access Control, specifically highlighting failures in authorization checks that allow unauthorized actors to perform privileged functions. It also maps directly to MITRE ATT&CK technique T1078, Valid Accounts, although in this specific case, it applies even more severely as an unauthenticated attack vector (T1546.003 or similar privilege escalation paths depending on subsequent exploitation). The vulnerability essentially allows a low-privilege or non-existent actor to perform high-impact administrative actions, creating a direct path for abuse of functionality that should be restricted to trusted personnel.
Mitigation strategies must focus immediately on patching the affected software versions by upgrading to Chamilo LMS 2.0.0 RC.3 or later, where these access control checks have been implemented in the GradebookController. For organizations unable to upgrade instantly due to compatibility constraints, temporary mitigations should include placing a reverse proxy in front of the application to explicitly block direct access to the set_default_certificate endpoint for unauthenticated users. Additionally, implementing strict input validation and ensuring that all API endpoints enforce session-based authentication checks before executing any state-changing operations is essential. Security teams should also audit other controller methods within the Gradebook module to ensure no similar authorization gaps exist elsewhere in the application logic.