CVE-2026-114389

Received Received - Intake

Authenticated AI Grading Access in Chamilo LMS

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: VulnCheck

Description

Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in AiController::openAnswerGrade that allows any authenticated user to obtain AI grading of other students' exam attempts. Attackers can enumerate exeId and questionId values sent to the open_answer_grade endpoint to expose other students' answers through feedback and consume AI quota.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-21

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-114389

EUVD

EUVD-2026-107236

Affected Vendors & Products

Vendor	Product	Version / Range
chamilo	chamilo-lms	2.0.0-alpha.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is a missing authorization flaw in Chamilo LMS versions 2.0.0-alpha.4 to 2.0.0-RC.2. It allows any authenticated user to access AI grading of other students' exam attempts by sending specific parameters to the open_answer_grade endpoint. Attackers can enumerate exeId and questionId values to view other students' answers through feedback and consume AI quota.

Detection Guidance

To detect this vulnerability, monitor network traffic for requests to the open_answer_grade endpoint in Chamilo LMS. Check for repeated requests with varying exeId and questionId parameters from non-teacher accounts. Inspect logs for unauthorized access attempts to AI grading features.

Impact Analysis

This vulnerability allows unauthorized users to view other students' exam answers and misuse AI resources. Students' personal data and exam content could be exposed, leading to privacy violations and potential academic misconduct. Institutions may face reputational damage and loss of trust.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to students' personally identifiable information (PII) and exam data. GDPR requires strict data protection and user consent, while HIPAA mandates safeguards for protected health information. The exposure of such data could result in legal penalties and compliance failures.

Mitigation Strategies

Upgrade Chamilo LMS to version 2.0.0-RC.3 or later to apply security fixes. Review and enforce role-based access controls in security.yaml. Implement input validation for exeId and questionId parameters in AiController.

Hi! I’m here to help you understand CVE-2026-114389. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...