An Insecure Direct Object Reference vulnerability in Chamilo LMS allows authenticated teachers to modify sensitive evaluation data across different courses, posing a significant risk to data integrity.

The flaw is an Insecure Direct Object Reference (CWE-639) located in the gradebook evaluation edit page. By manipulating the editeval GET parameter, any authenticated teacher can bypass authorization controls to view or alter evaluation parameters, such as names, scores, and weights, in courses they do not manage.

The vulnerability allows for the unauthorized modification of gradebook data, which directly impacts the integrity of academic records and institutional reporting. With a CVSS score of 7.1, this high-severity flaw could lead to systematic grade manipulation, loss of trust in the learning management system, and potential administrative overhead to audit and correct corrupted course evaluations.

Immediate Action: Update Chamilo LMS to version 1.11.38 or 2.0.0-RC.3 immediately to incorporate the required authorization checks.

Proactive Monitoring: Review web server access logs for suspicious patterns, specifically monitoring for frequent or unusual requests involving the editeval GET parameter.

Compensating Controls: Implement Web Application Firewall rules to inspect and filter requests containing the editeval parameter if an immediate software update is operationally unfeasible.

Public Exploit Available: No (exploit_available: false)

Given the high impact on data integrity and the availability of a vendor-provided fix, organizations must prioritize patching their Chamilo LMS instances. Failure to apply these updates leaves the system exposed to unauthorized manipulation of academic evaluations, which may have long-term consequences for institutional data accuracy.