PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-114389 chamilo CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-10-21T12:39:45.983Z and has not been modified since then. Chamilo LMS 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in AiController::openAnswerGrade that allows any authenticated user to obtain AI grading of other students' exam attempts. The vulnerability allows any authenticated user to obtain AI grading of other students' exam attempts by enumerating exeId and questionId values sent to the open_answer_grade endpoint.

Vendor
chamilo
Product
chamilo-lms
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-21
Original CVE updated
2026-10-21
Advisory published
2026-10-21
Advisory updated
2026-10-21

Who should care

Defenders responsible for Chamilo LMS environments, particularly those with AI grading functionality, should assess exposure and verify access controls. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review and mitigate the vulnerability. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Why it matters

The missing authorization vulnerability in Chamilo LMS 2.0.0-alpha.4 before 2.0.0-RC.3 allows authenticated users to access AI grading of other students' exam attempts, potentially leading to unauthorized access and AI quota consumption.

  • Potential unauthorized access to AI grading of student exam attempts
  • Consumption of AI quota by unauthorized users
  • Exposure of student exam answers through feedback

Technical summary

The vulnerability allows any authenticated user to obtain AI grading of other students' exam attempts by enumerating exeId and questionId values sent to the open_answer_grade endpoint. This could lead to unauthorized access and AI quota consumption. The vulnerability is in Chamilo LMS 2.0.0-alpha.4 before 2.0.0-RC.3 and affects AI grading functionality. Defenders should prioritize verifying AI grading access controls and assessing exposure in their Chamilo LMS environments. Technical details are limited to CVE and source-item descriptions.

Defensive priority

Defenders should prioritize verifying AI grading access controls and assessing exposure in their Chamilo LMS environments.

Recommended defensive actions

  • Verify AI grading access controls in Chamilo LMS environments
  • Assess exposure to the missing authorization vulnerability
  • Update to version 2.0.0-RC.3 or later
  • Monitor AI quota consumption and student exam attempts
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the missing authorization vulnerability in Chamilo LMS 2.0.0-alpha.4 before 2.0.0-RC.3. The vulnerability allows any authenticated user to obtain AI grading of other students' exam attempts. Evidence is limited to CVE and source-item details. Defenders should verify AI grading access controls and assess exposure in their Chamilo LMS environments with explicit evidence-limit language.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-114389 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-114389

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-114389 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-114389

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Chamilo LMS 2.0.0-alpha.4 before 2.0.0-RC.3 Missing Authorization via openAnswerGrade

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/114xxx/CVE-2026-114389.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/chamilo/chamilo-lms/issues/7671

    Supplemental source - issue-tracking

  • Source reference

    Unverified legacy reference

    URL: https://github.com/chamilo/chamilo-lms/commit/2861afd4896ff898a950302f2c00f44726fa6f0a

    Supplemental source - patch

  • Source reference

    Unverified legacy reference

    URL: https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3

    Supplemental source - release-notes

  • Source reference

    Unverified legacy reference

    URL: https://github.com/chamilo/chamilo-lms/blob/v2.0.0-RC.2/src/CoreBundle/Controller/AiController.php

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/chamilo-lms-2.0.0-alpha.4-before-2.0.0-rc.3-missing-authorization-via-openanswergrade

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.