A missing access control flaw in the GradebookController allows anyone who can reach the web interface to request the set_default_certificate endpoint with arbitrary course and document identifiers. This flaw permits unauthorized users to change the certificate configuration for any course, potentially altering the representation of student achievements. The vulnerability is a classic example of missing authorization identified by CWE-862.

All Chamilo LMS 2.0.0 pre‑release versions from 2.0.0‑alpha.1 up to but not including 2.0.0‑RC.3 are affected.

The CVSS score of 6.9 indicates a moderate severity, while the EPSS score is not available, suggesting limited publicly reported exploitation data. The vulnerability is not listed in the CISA KEV catalog, and no authentication is required for use. Attackers could simply send an HTTP request to the vulnerable endpoint, so the practical exploitation vector remains remote and straightforward, but the lack of an EPSS score could imply a lower immediate threat relative to high‑severity, widely exploited flaws.