SB2026080471 - Multiple vulnerabilities in Chamilo LMS

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080471

SB2026080471 - Multiple vulnerabilities in Chamilo LMS

Published: August 4, 2026

Security Bulletin ID SB2026080471
CSH Severity
High
Patch available
YES
Number of vulnerabilities 35
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 14% Medium 29% Low 57%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 35 vulnerabilities.


1) Improper Neutralization of Special Elements Used in a Template Engine (CVE-ID: CVE-2026-61558)

CWE-ID: CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of special elements used in a template engine in the mail template renderer when compiling a stored mail template from a raw string with the non-sandboxed Twig environment. A remote privileged user can place a crafted Twig payload in the editable mail template to execute arbitrary code.

Execution is triggered when the approval mail is built during new user self-registration if admin approval of accounts is enabled.


2) Path traversal (CVE-ID: CVE-2026-61603)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to path traversal in the Moodle course import handler in public/main/inc/lib/MoodleImport.php when extracting a crafted .mbz archive. A remote user can upload a crafted backup archive containing path-traversal entries to write files to arbitrary server locations and execute arbitrary code.

Exploitation requires teacher-level access with course import capability, and code execution occurs as the web server user.


3) Open redirect (CVE-ID: CVE-2026-61602)

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to redirect victims to attacker-controlled sites.

The vulnerability exists due to improper input validation in main/calendar/ical_export.php when handling error paths that issue redirects based on the HTTP_REFERER header. A remote user can supply a crafted referer value to redirect victims to attacker-controlled sites.

The issue is usable for phishing and redirect chaining.


4) Cross-site scripting (CVE-ID: CVE-2026-61601)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary JavaScript in the victim's browser.

The vulnerability exists due to cross-site scripting in HTML href attributes in main/extra/myStudents.php when processing the origin and course query parameters. A remote user can send a specially crafted URL to execute arbitrary JavaScript in the victim's browser.

User interaction is required, and the victim must open a crafted URL while viewing the vulnerable page.


5) SQL injection (CVE-ID: CVE-2026-61600)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to SQL injection in main/inc/ajax/model.ajax.php and main/work/pending.php when handling attacker-controlled parameters in SQL WHERE clauses. A remote attacker can send specially crafted requests with malicious course_id, work_parent_ids, or filters values to disclose sensitive information.

One reachable variant is accessible before authentication when a valid cidReq is known, while other variants require roles ranging from student to teacher, session admin, or administrator.


6) Missing Authentication for Critical Function (CVE-ID: CVE-2026-61587)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper access control in session.ajax.php when handling the session_info and get_description actions. A remote attacker can send crafted unauthenticated requests to disclose sensitive information.

The issue allows enumeration of session records, extra-field metadata, and session descriptions, which may aid reconnaissance and tenant mapping.


7) LDAP injection (CVE-ID: CVE-2026-61585)

CWE-ID: CWE-90 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to LDAP injection in LDAP-integration code paths when building LDAP search filters from user-controlled values. A remote attacker can supply crafted input in parameters such as annee, login/username, or keyword_* to disclose sensitive information.

Exploitation is possible only in deployments with LDAP authentication or LDAP user import enabled.


8) Cross-site scripting (CVE-ID: CVE-2026-61577)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary JavaScript in a victim's authenticated session.

The vulnerability exists due to cross-site scripting in the social wall content rendering path when rendering stored wall posts or comments containing crafted HTML. A remote user can submit a crafted wall post or comment to execute arbitrary JavaScript in a victim's authenticated session.

User interaction is required when a victim opens the affected user's social wall.


9) Incorrect authorization (CVE-ID: CVE-2026-54748)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify course tool-introduction content and execute arbitrary script in other users' browsers.

The vulnerability exists due to improper authorization in the ResourceVoter for AbstractResource-gated entities when handling API Platform endpoints and legacy access checks. A remote user can access and modify CToolIntro objects outside their authorized scope to modify course tool-introduction content and execute arbitrary script in other users' browsers.

The issue can affect resources protected only by this voter, and exploitation can cross tenant and course boundaries.


10) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-61615)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:L/SI:N/SA:N]


The vulnerability allows a remote user to perform server-side request forgery and disclose sensitive information.

The vulnerability exists due to server-side request forgery in the legacy certificate generation path in public/main/inc/lib/certificate.lib.php when rendering certificate HTML with mPDF. A remote privileged user can modify a certificate template to include a crafted URL and trigger server-side HTTP requests to disclose sensitive information.

The issue is persistent once a malicious template is planted, and any user generating a certificate can trigger the server-side request. Cloud metadata endpoints and internal network services may be reachable through the vulnerable request behavior.


11) Deserialization of Untrusted Data (CVE-ID: CVE-2026-61538)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to deserialization of untrusted data in the course-backup diagnose endpoint when processing an uploaded backup ZIP containing attacker-controlled course_info.dat data. A remote user can upload a crafted backup and trigger a PHP object injection gadget chain to execute arbitrary code.

If self-registration as teacher is enabled, exploitation may be reachable starting from an anonymous user.


12) PHP file inclusion (CVE-ID: CVE-2026-54750)

CWE-ID: CWE-98 - Improper Control of Filename for Include/Require Statement in PHP Program

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper control of filename for include/require statement in PHP program in the CStudio plugin language include logic when processing the cstudio_lang cookie value. A remote user can supply a crafted cookie and chain the issue with the plugin's file write capabilities to execute arbitrary code.

The CStudio plugin must be installed and enabled for exploitation.


13) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-61537)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to authorization bypass through a user-controlled key in /api/messages/by-group/list when handling requests with a user-supplied groupId query parameter. A remote user can iterate numeric group identifiers and send a crafted request to disclose sensitive information.

Multi-portal deployments are exposed cross-portal because the query does not filter by AccessUrl.


14) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-61533)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to authorization bypass through a user-controlled key in the TrackEAttempt API collection endpoint when handling crafted GET requests with user-controlled filters. A remote user can query /api/track_e_attempts with another user's identifier to disclose sensitive information.

The issue affects collection results because only the single-item access path is voter-protected, while collection members are not scoped to the requesting user.


15) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-61733)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to authorization bypass through a user-controlled key in /api/usergroups/{id}/members when handling requests with a user-supplied group id. A remote user can iterate numeric group identifiers to disclose sensitive information.

Private and closed groups, administrative classes, and cross-portal group rosters may be exposed.


16) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-61734)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to read other users' Web Push secrets, hijack Web Push notifications, and delete push subscriptions to cause a denial of service.

The vulnerability exists due to improper authorization and improperly controlled modification of dynamically-determined object attributes in the /api/push_subscriptions endpoint when handling authenticated API requests. A remote user can supply another user's identifier in the request body or access another user's subscription object to read sensitive fields, re-route notifications to an attacker-controlled endpoint, or delete another user's subscription to read other users' Web Push secrets, hijack Web Push notifications, and delete push subscriptions to cause a denial of service.

Exploitation can expose cryptographic Web Push material including endpoint, publicKey, and authToken, and can affect private messages, MFA codes, password-reset links, and course announcements delivered through the Web Push feature.


17) Missing Authorization (CVE-ID: CVE-2026-61531)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify blog content and disclose sensitive information.

The vulnerability exists due to missing authorization in the blog API endpoints when handling requests for blog and blog post resources. A remote user can send crafted API requests targeting blogs or posts outside their own course or session scope to modify blog content and disclose sensitive information.

The issue can be exploited across course or session boundaries against blogs owned by users who are not in the attacker's course or session.


18) Missing Authorization (CVE-ID: CVE-2026-61530)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify assignment submission feedback and grading data across course or session boundaries.

The vulnerability exists due to missing authorization in the POST /api/c_student_publication_comments/upload endpoint when handling attacker-controlled submission identifiers. A remote user can send a specially crafted request with an arbitrary submissionId to modify assignment submission feedback and grading data across course or session boundaries.

The issue also allows modification of qualification, qualificator_id, and date_of_qualification fields on the targeted submission.


19) Missing Authorization (CVE-ID: CVE-2026-61660)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to missing authorization in ValidationTokenController when handling validation-token generation and redemption requests. A remote user can send crafted requests to forge validation tokens for arbitrary resources and invoke privileged token-gated operations to escalate privileges.

The issue includes an exposed test/debug token-generation endpoint and the token redemption flow honors an attacker-supplied user_id, allowing actions to be applied to other users.


20) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-62307)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information and copy private course resources.

The vulnerability exists due to authorization bypass through a user-controlled key in the Course Maintenance copy endpoints when handling a user-supplied sourceCourseId. A remote user can supply an arbitrary course code as the source course identifier to disclose sensitive information and copy private course resources.

Exploitation requires access to any destination course.


21) Missing Authorization (CVE-ID: CVE-2026-62306)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to modify application data.

The vulnerability exists due to missing authorization in the /template/document-templates/create endpoint when handling template creation and document modification requests. A remote attacker can send a crafted request to modify application data.

The issue can be exploited to create document templates, alter template associations, and mark arbitrary documents as templates.


22) Missing Authorization (CVE-ID: CVE-2026-62305)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to modify application data.

The vulnerability exists due to missing authorization in /template/document-templates/{documentId}/delete endpoint when handling delete requests for document templates. A remote attacker can send a crafted request to modify application data.

The issue can be exploited without authentication to delete document templates, modify template associations, and alter course content configuration.


23) Missing Authorization (CVE-ID: CVE-2026-62304)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to missing authorization in the /template/all-templates/{courseId} endpoint when handling requests for course template data. A remote attacker can send a request for an arbitrary course ID to disclose sensitive information.

The issue can expose template metadata and template content from private courses without authentication.


24) Improper privilege management (CVE-ID: CVE-2026-61786)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to improper privilege management in the switch_user feature when processing a crafted impersonation request. A remote attacker can send a specially crafted request to escalate privileges.

The issue allows impersonation of any account, including a global administrator, because no restriction is enforced on the target user's privilege.


25) Improperly Controlled Modification of Dynamically-Determined Object Attributes (CVE-ID: CVE-2026-61785)

CWE-ID: CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to improperly controlled modification of dynamically-determined object attributes in registration.php and UserManager::create_user() when processing self-registration requests. A remote attacker can submit a crafted status field during registration to escalate privileges.

User interaction is required to complete registration, and the issue can assign the session administrator or HR role instead of the intended student or teacher role.


26) Path traversal (CVE-ID: CVE-2026-61665)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to write arbitrary files and execute arbitrary code.

The vulnerability exists due to path traversal in the sub-language translation editor endpoint and SubLanguageManager::updateOrAddMsgid() when processing a user-supplied filename parameter. A remote privileged user can send a specially crafted request to write arbitrary files and execute arbitrary code.

The affected endpoint is gated by api_protect_admin_script(), and writing a script within the web root can lead to code execution.


27) Relative Path Traversal (CVE-ID: CVE-2026-61661)

CWE-ID: CWE-23 - Relative Path Traversal

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to relative path traversal in FileManagerController download endpoint when processing a user-supplied filename route parameter. A remote user can supply a url-encoded directory-traversal sequence to disclose sensitive information.

The issue can expose files outside the intended directory, including operating system files and application configuration such as database credentials and APP_SECRET.


28) SQL injection (CVE-ID: CVE-2026-62983)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary SQL commands.

The vulnerability exists due to improper neutralization of special elements used in an SQL command in ExtraField::get_where_clause() when processing a JSON filters blob containing array values for extra field rules. A remote privileged user can send a specially crafted filters array to execute arbitrary SQL commands.

The issue is specific to the array-handling branch, while the scalar branch is handled safely.


29) Cross-site scripting (CVE-ID: CVE-2026-61659)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary JavaScript in victims' browsers.

The vulnerability exists due to cross-site scripting in the group discussion title field when rendering stored thread titles on the group page. A remote user can create a discussion thread with a malicious title to execute arbitrary JavaScript in victims' browsers.

User interaction is required for a group member to visit the group page containing the malicious thread title.


30) XML External Entity injection (CVE-ID: CVE-2026-61658)

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper restriction of xml external entity reference in the user import endpoint when parsing uploaded XML files. A remote privileged user can upload a specially crafted XML file to disclose sensitive information.

Successful exploitation can expose arbitrary local files from the server filesystem, including configuration files containing database credentials.


31) Cross-site request forgery (CVE-ID: CVE-2026-61656)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 8.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to manipulate student grades and evaluation data.

The vulnerability exists due to cross-site request forgery in the Gradebook module endpoints responsible for managing evaluations and grades when handling crafted GET requests without proper anti-CSRF token validation. A remote attacker can trick a victim into visiting a maliciously crafted webpage to manipulate student grades and evaluation data.

User interaction is required, and exploitation targets authenticated administrator, teacher, or course coach sessions.


32) Cross-site scripting (CVE-ID: CVE-2026-61655)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary JavaScript in the browser of another administrator and disclose session cookies.

The vulnerability exists due to cross-site scripting in the languages.php admin language management interface when rendering a user-controlled language name inside an HTML value attribute. A remote privileged user can inject a malicious language name containing double quotes to execute arbitrary JavaScript in the browser of another administrator and disclose session cookies.

User interaction is required because another administrator must view or edit the affected language entry.


33) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-61624)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N]


The vulnerability allows a remote user to perform server-side request forgery and access internal or cloud-hosted resources.

The vulnerability exists due to improper control of server-side request targets in the wiki PDF export in public/main/wiki/wiki.inc.php when rendering user-controlled wiki HTML to PDF. A remote user can embed external URLs in <img src> attributes or CSS url() values to perform server-side request forgery and access internal or cloud-hosted resources.

Exploitation requires the ability to edit a wiki page, and the server-side request is triggered when a wiki page is exported to PDF.


34) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-61623)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to authorization bypass through a user-controlled key in public/main/my_space/myStudents.php when handling a user-supplied student parameter. A remote user can supply an arbitrary student parameter to disclose sensitive information.

The issue exposes quiz scores, learning progress, time-on-task, last login, and personal details for students not enrolled in any course taught by the requesting teacher.


35) Deserialization of Untrusted Data (CVE-ID: CVE-2026-61622)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to deserialization of untrusted data in Sequence::getUnSerializeGraph() when processing database-stored sequence graph data. A remote attacker can write a crafted PHP gadget chain into the sequence.graph column to execute arbitrary code.

Exploitation requires the ability to write to the sequence.graph column, and code execution is triggered when an authenticated user visits a sequence page.


Remediation

Install update from vendor's website.

References