{"id":"CVE-2026-114389","kind":"vulnerability","aliases":["CVE-2026-114389"],"related":[],"title":"Chamilo LMS: missing authorization lets students read others' exam grades","description":"Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in AiController::openAnswerGrade that allows any authenticated user to obtain AI grading of other students' exam attempts. Attackers can enumerate exeId and questionId values sent to the open_answer_grade endpoint to expose other students' answers through feedback and consume AI quota.","summary":"Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 has a missing authorization check in the AI open-answer grading endpoint. Any logged-in user can request AI grading of other students' exam attempts, exposing their answers through the feedback and consuming AI quota.","severity":"medium","cvss":5.3,"epss":0.00274,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["chamilo-lms","education","package","php","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed Chamilo version in the platform admin panel or `version.php`, or `unknown` if the sources do not say where to read it\n- Confirm whether the AI grading feature is enabled and reachable by students","fix":"- Upgrade Chamilo LMS to `2.0.0-RC.3` or later\n- Until upgraded, restrict or disable the AI open-answer grading feature for student roles","status":"open","published_at":"2026-10-21T13:18:29+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T04:20:57+00:00","updated_at":"2026-10-25T04:20:57+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:20:57Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Chamilo LMS to `2.0.0-RC.3` or later\n- Until upgraded, restrict or disable the AI open-answer grading feature for student roles","reach":"internet","title":"Chamilo LMS: missing authorization lets students read others' exam grades","impact":"medium","summary":"Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 has a missing authorization check in the AI open-answer grading endpoint. Any logged-in user can request AI grading of other students' exam attempts, exposing their answers through the feedback and consuming AI quota.","category":"package","nicknames":[],"who_cares":["chamilo-lms","php","self-hosted","education"],"confidence":0.7,"needs_auth":"yes","worst_case":"Other students' exam answers are readable and AI quota is consumed","analyst_note":"","how_to_check":"- Check the installed Chamilo version in the platform admin panel or `version.php`, or `unknown` if the sources do not say where to read it\n- Confirm whether the AI grading feature is enabled and reachable by students","needs_analyst":false,"not_affected_if":["default-config"],"who_is_affected":"Installations running Chamilo LMS from `2.0.0-alpha.4` up to but not including `2.0.0-RC.3` where any authenticated student account can reach the AI open-answer grading endpoint. Sites on older or newer releases, or sites that do not use the AI grading feature, are not described as exposed by the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000622,"input_tokens":3410,"output_tokens":562,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114389':13A,16A '-2026':12A,15A '2.0.0':29B,32B,74C,77C 'ai':41B,54B,69B,94C,124C 'aicontrol':85C 'allow':88C 'alpha.4':30B,75C 'answer':44B,63B,112C,119C 'attack':101C 'attempt':60B,100C 'authent':90C 'author':4A,37B,82C 'chamilo':1A,18B,26B,71C 'chamilo-lm':17B 'check':38B 'consum':68B,123C 'contain':79C 'cve':11A,14A 'educ':20B 'endpoint':46B,114C 'enumer':103C 'exam':9A,59B,99C 'exeid':104C 'expos':61B,116C 'feedback':66B,121C 'grade':10A,45B,55B,95C,113C 'host':25B 'let':5A 'lms':2A,19B,27B,72C 'log':49B 'logged-in':48B 'miss':3A,36B,81C 'obtain':93C 'open':43B,111C 'open-answ':42B 'openanswergrad':86C 'other':8A 'packag':21B 'php':22B 'questionid':106C 'quota':70B,125C 'rc.3':33B,78C 'read':7A 'request':53B 'self':24B 'self-host':23B 'sent':108C 'student':6A,58B,98C,118C 'user':51B,91C 'valu':107C 'vulner':83C","nicknames":[],"mitigations":[],"who_affected":"Installations running Chamilo LMS from `2.0.0-alpha.4` up to but not including `2.0.0-RC.3` where any authenticated student account can reach the AI open-answer grading endpoint. Sites on older or newer releases, or sites that do not use the AI grading feature, are not described as exposed by the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T13:18:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114389","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114389","severity":null,"published_at":"2026-10-21T13:18:29+00:00","modified_at":"2026-10-22T17:40:46+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114389","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114389","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}