PT-2026-120575

CVE-2026-114388

Published

2026-10-21

Updated

2026-10-21

Description by

CVSS 4.0

6.9

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions 2.0.0-alpha.1 through 2.0.0-RC.2

Description Missing access control in the GradebookController allows unauthenticated users to modify gradebook certificates. An attacker can tamper with the certificate configuration for any course by requesting the 'set default certificate' endpoint using any course id and document id.

Recommendations Update Chamilo LMS to version 2.0.0-RC.3 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Leediay153

Lighthousekeeper1212

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization