Is CVE-2026-32930 actively exploited?

CVE-2026-32930 has no public evidence of in-the-wild exploitation as of 2026-04-17.

What is the CVSS score for CVE-2026-32930?

CVE-2026-32930 has a CVSS score of 7.1 (HIGH severity). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N.

How do I patch CVE-2026-32930?

Patch guidance is available from chamilo security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2026-32930.

Fix CVE-2026-32930 - HIGH chamilo chamilo lms

Q: Which products are affected by CVE-2026-32930?

11 products: chamilo chamilo lms, chamilo chamilo lms, chamilo chamilo lms, chamilo chamilo lms, chamilo chamilo lms, and 6 more.

Description

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the gradebook evaluation edit page allows any authenticated teacher to view and modify the settings (name, max score, weight) of evaluations belonging to any other course by manipulating the editeval GET parameter. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

CVSS Metrics

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Attack Vector: network
Complexity: low
Privileges: low
User Action: none
Scope: unchanged
Confidentiality: low
Integrity: high
Availability: none
Weaknesses: CWE-639

Metadata

Primary Vendor: CHAMILO
Published: 4/10/2026
Last Modified: 4/17/2026
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

chamilo : chamilo_lmschamilo : chamilo_lmschamilo : chamilo_lmschamilo : chamilo_lmschamilo : chamilo_lmschamilo : chamilo_lmschamilo : chamilo_lmschamilo : chamilo_lmschamilo : chamilo_lmschamilo : chamilo_lmschamilo : chamilo_lms

Remediation Guidance

Executive Summary

View on NIST NVD