Vulnerability · Published Apr 10, 2026 · Assigned by GitHub_M

CVE-2026-32932Chamilo LMS has an Open Redirect via Unvalidated 'page' Parameter in Session Course Edit

Medium 4.7

In plain English

A medium-severity open redirect in chamilo-lms from chamilo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)0.2%top 92.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Open Redirect vulnerability in the session course edit page allows an attacker to redirect an authenticated administrator to an arbitrary external URL after saving coach assignment changes. The redirect also leaks the id_session parameter to the attacker's server. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

Affected products (as reported)

Vendor	Product	Versions
chamilo	chamilo-lms	< 1.11.38>= 2.0.0-alpha.1, < 2.0.0-RC.3

Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

References

https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-q2cp-3qj3-wx8q x_refsource_CONFIRM
https://github.com/chamilo/chamilo-lms/commit/b005b3d3e76cf6eafc03e15ac445ceff089551c0 x_refsource_MISC
https://github.com/chamilo/chamilo-lms/commit/fbd8d7eb37d05ec974293f05b6ffaaf9102ebd2b x_refsource_MISC