Live › vulnerability › CVE-2026-114389
Go to dashboardChamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 has a missing authorization check in the AI open-answer grading endpoint. Any logged-in user can request AI grading of other students' exam attempts, exposing their answers through the feedback and consuming AI quota.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Installations running Chamilo LMS from 2.0.0-alpha.4 up to but not including where any authenticated student account can reach the AI open-answer grading endpoint. Sites on older or newer releases, or sites that do not use the AI grading feature, are not described as exposed by the sources.
2.0.0-RC.3No product ranges from the sources yet.
version.php, or unknown if the sources do not say where to read it2.0.0-RC.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in AiController::openAnswerGrade that allows any authenticated user to obtain AI grading of other students' exam attempts. Attackers can enumerate exeId and questionId values sent to the open_answer_grade endpoint to expose other students' answers through feedback and consume AI quota.
This page as .md · .json · in your agent: get_signal("CVE-2026-114389")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.