CVE-2026-32932

Description

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Open Redirect vulnerability in the session course edit page allows an attacker to redirect an authenticated administrator to an arbitrary external URL after saving coach assignment changes. The redirect also leaks the id_session parameter to the attacker's server. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

PUBLISHED Reserved 2026-03-17 | Published 2026-04-10 | Updated 2026-04-13 | Assigner GitHub_M

Problem types

CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

Product status

References

github.com/...lo-lms/security/advisories/GHSA-q2cp-3qj3-wx8q

github.com/...ommit/b005b3d3e76cf6eafc03e15ac445ceff089551c0

github.com/...ommit/fbd8d7eb37d05ec974293f05b6ffaaf9102ebd2b

cve.org (CVE-2026-32932)

nvd.nist.gov (CVE-2026-32932)

Download JSON