CVE-2026-114389— Chamilo LMS 2.0.0-alpha.4 before 2.0.0-RC.3 Missing Authorization via openAnswerGrade
Quick assessment
Affected
chamilo chamilo-lms
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Chamilo LMS 从 2.0.0-alpha.4 版本起至 2.0.0-RC.3 之前的版本中，AiController::openAnswerGrade 函数存在授权缺失漏洞。该漏洞允许任何已认证用户获取其他学生考试尝试的 AI 评分结果。攻击者可通过枚举发送至 open_answer_grade 接口的 exeId 和 questionId 参数，利用反馈信息泄露其他学生的答题内容，并消耗 AI 评分配额。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-114389
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Chamilo LMS 2.0.0-alpha.4 before 2.0.0-RC.3 Missing Authorization via openAnswerGrade
Source: CVE Program / CVE List V5
Vulnerability Description
Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in AiController::openAnswerGrade that allows any authenticated user to obtain AI grading of other students' exam attempts. Attackers can enumerate exeId and questionId values sent to the open_answer_grade endpoint to expose other students' answers through feedback and consume AI quota.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| chamilo | chamilo-lms | 2.0.0-alpha.4 ~ 2.0.0-RC.3 | - |
|
II. Public POCs for CVE-2026-114389
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-114389
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-114389 (1)
Vendor Advisories for CVE-2026-114389 (1)
Vendor Pages for CVE-2026-114389 (1)
Same Patch Batch · chamilo · 2026-10-21 · 3 CVEs total
| CVE-2026-114390 | 5.3 MEDIUM | Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization in AJAX Handlers |
| CVE-2026-114388 | 5.3 MEDIUM | Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization via GradebookController |
IV. Related Vulnerabilities
Same product: chamilo-lms
-
CVE-2026-114390
Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authoriz -
CVE-2026-114388
Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authoriz -
CVE-2026-45140
Chamilo LMS CStudio upload flow allows unauthenticated remot -
CVE-2026-45143
Chamilo LMS: Student-to-admin stored XSS in private messages -
CVE-2026-82535
Chamilo LMS Stored XSS via Survey Answer Submission in repor
Same vendor: chamilo
-
CVE-2026-114390
Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authoriz -
CVE-2026-114388
Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authoriz -
CVE-2026-112031
Chamilo LMS Ticket TicketManager.php addProject cross site s -
CVE-2026-45140
Chamilo LMS CStudio upload flow allows unauthenticated remot -
CVE-2026-45143
Chamilo LMS: Student-to-admin stored XSS in private messages
Same weakness: CWE-639
-
CVE-2026-112868
WordPress H5P plugin <= 1.17.9 - Insecure Direct Object Refe -
CVE-2026-114395
Trudesk through 1.2.11 Authorization Bypass via /api/v1/mess -
CVE-2026-114393
Trudesk through 1.2.11 Authorization Bypass via Ticket Updat -
CVE-2026-114394
Trudesk through 1.2.11 Authorization Bypass via Ticket Comme -
CVE-2026-114392
Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/
V. Comments for CVE-2026-114389
No comments yet