CVE-2026-114389

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions 2.0.0-alpha.4 through 2.0.0-RC.2

Description An authorization flaw exists in the openAnswerGrade() function within the AiController. This issue allows any authenticated user to access AI grading for exam attempts belonging to other students. By enumerating the exeId and questionId variables sent to the 'open answer grade' endpoint, an attacker can expose other students' answers via feedback and deplete the AI quota.

Recommendations Update Chamilo LMS to version 2.0.0-RC.3 or later. As a temporary mitigation, restrict access to the 'open answer grade' endpoint.