CVE-2026-114388: 
Chamilo vulnerability analysis and mitigation

CVE-2026-114388 is a Missing Authorization vulnerability in Chamilo LMS's GradebookController that allows unauthenticated remote attackers to modify gradebook certificate configurations for any course. It affects Chamilo LMS 2.0.0 pre-releases from version 2.0.0-alpha.1 up to (but not including) 2.0.0-RC.3. The vulnerability was reported on March 4, 2026, patched in commit 2861afd on March 13, 2026, and publicly disclosed on October 21, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (Github Advisory, Feedly).

The root cause is CWE-862 (Missing Authorization): the setDefaultCertificate() method in GradebookController.php lacked any #[IsGranted] attribute or equivalent access control check, and Chamilo's security.yaml had no default-deny catch-all rule, making every route publicly accessible unless individually protected (GitHub Issue). An attacker can send an unauthenticated HTTP request directly to the /gradebook/set_default_certificate/{cid}/{certificateId} endpoint, supplying arbitrary course and document IDs, causing the application to update the gradebook category's default certificate in the database without verifying the requester's identity or permissions (GitHub Source). No authentication, special privileges, or user interaction are required for exploitation. The same systemic issue also affected several other controllers and AJAX endpoints in the same codebase (GitHub Issue).

Successful exploitation allows an unauthenticated attacker to tamper with the default certificate document associated with any course's gradebook category, potentially replacing legitimate certificates with arbitrary documents for any course on the platform. This is a pure integrity impact — there is no confidentiality or availability impact — but it could undermine the trustworthiness of academic credentials issued by the LMS, affecting all courses and their enrolled students. Because the affected versions are pre-release (alpha/RC), the scope of real-world deployment is limited compared to a stable release (Github Advisory, Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The EPSS score is 0.0, indicating very low probability of exploitation in the near term, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The attack is trivially executable by any unauthenticated network user given the absence of any access control on the endpoint, but the affected versions are pre-release software, limiting the exposed population (Github Advisory).

1. Reconnaissance: Identify internet-accessible Chamilo LMS instances running a 2.0.0 pre-release version (2.0.0-alpha.1 through 2.0.0-RC.2) using web search, Shodan, or Censys queries targeting Chamilo-specific paths.
2. Enumerate course and document IDs: Access publicly available course listing endpoints (e.g., /catalogue/courses) or the unauthenticated getCategories endpoint (/gradebook/categories?courseId=<id>) to enumerate valid course IDs. Document IDs may be guessed sequentially or inferred from other unauthenticated endpoints.
3. Craft the malicious request: Send an unauthenticated HTTP GET or POST request to the vulnerable endpoint: GET /gradebook/set_default_certificate/{cid}/{certificateId} substituting target course and document IDs.
4. Confirm tampering: Verify the certificate change by querying the read endpoint GET /gradebook/default_certificate/{cid} and confirming the certificateId in the response matches the attacker-supplied value.
5. Achieve objective: The gradebook category for the targeted course now references the attacker-chosen document as its default certificate, potentially disrupting certificate issuance for course completions (GitHub Issue, GitHub Source).

• Network: Unauthenticated HTTP requests (no session cookie or Authorization header) to /gradebook/set_default_certificate/<int>/<int> in web server access logs; repeated requests with varying integer path parameters suggesting enumeration.
• Logs: Web server access logs showing 200 OK responses to /gradebook/set_default_certificate/ from unauthenticated sessions; Symfony application logs recording database flush operations on GradebookCategory entities without an associated authenticated user context.
• Database: Unexpected changes to the gradebook_category table's certificate/document foreign key column, particularly if the referenced document does not belong to the associated course or was modified outside normal teacher/admin workflows.

Upgrade Chamilo LMS to version 2.0.0-RC.3 or later, which includes commit 2861afd that adds #[IsGranted('IS_AUTHENTICATED_FULLY')] at the GradebookController class level and #[IsGranted('ROLE_TEACHER')] plus CourseVoter::EDIT authorization on the setDefaultCertificate method (GitHub Commit, RC.3 Release). As a temporary workaround for those unable to upgrade immediately, restrict network access to the /gradebook/ route path via web server or firewall rules to authenticated sessions only, or add an access_control entry in security.yaml requiring IS_AUTHENTICATED_FULLY for the /gradebook path prefix (GitHub Issue). Since this is a pre-release version, organizations should evaluate whether production deployment of pre-release Chamilo 2.0.0 software is appropriate.

The vulnerability was originally reported by security researcher lighthousekeeper1212 on March 4, 2026, as part of a broader security review identifying approximately 13 authorization vulnerabilities stemming from the same systemic root cause in Chamilo LMS. The Chamilo maintainer (ywarnier) acknowledged the findings, noted that the issues had also been independently detected via Claude Code, and addressed them in commit 2861afd within about 9 days of the report (GitHub Issue). The maintainer also requested that future security issues be reported through GitHub's private security advisory process rather than public issues. No significant broader media coverage or social media discussion has been identified.