An insecure direct object reference in the gradebook result view page allows an authenticated teacher to delete any student’s grade record by manipulating the delete_mark or resultdelete GET parameters. Because the application performs no ownership or course‑scope verification, the deletion can target any user across all courses, compromising the integrity of the grading system. The vulnerability is rooted in improper null reference handling (CWE‑476) and lack of authorization checks (CWE‑639). Any successful exploitation results in permanent removal of grade data, which can affect academic assessment and reporting.

The defect is present in versions of Chamilo LMS older than 1.11.38 and 2.0.0‑RC.3. Users running these legacy releases need to review their deployment and verify whether the gradebook module has been affected.

With a CVSS score of 7.1 the vulnerability is classified as high severity. While an EPSS score is not reported, the attack requires only that the actor be a logged‑in teacher with the ability to edit URLs, a common role in organizations using Chamilo. The exploit is straightforward, involving a simple GET request modification, and does not depend on advanced techniques, making it likely to be used by malicious insiders or compromised teacher accounts.