An Insecure Direct Object Reference vulnerability in Chamilo LMS allows authenticated teachers to delete arbitrary student grade records, posing a significant risk to academic data integrity.

The vulnerability exists in the gradebook result view page, where insufficient authorization checks on the delete_mark and resultdelete GET parameters allow any authenticated teacher to bypass course-scope restrictions and delete grade entries for any student on the platform.

Successful exploitation results in the unauthorized deletion of student assessment data, which compromises the integrity and availability of academic records. With a CVSS score of 7.1, this flaw is categorized as High severity, reflecting the potential for widespread data loss and the administrative burden required to restore academic records from backups.

Immediate Action: Update Chamilo LMS to version 1.11.38 or 2.0.0-RC.3 immediately to incorporate the necessary authorization checks.

Proactive Monitoring: Review web server access logs for anomalous requests targeting the gradebook result view page, specifically looking for unusual patterns in the delete_mark or resultdelete parameters.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block unauthorized attempts to modify grade-related GET parameters originating from users without appropriate administrative privileges for the specific course.

Public Exploit Available: Unknown.

Given the potential for unauthorized data destruction, system administrators must prioritize upgrading to the patched versions of Chamilo LMS. Failure to apply these updates leaves the platform vulnerable to malicious or accidental data loss, which could have severe consequences for institutional record-keeping and academic compliance.