Chamilo Learning Management System contains an in‑secure direct object reference in the gradebook evaluation edit page. By altering the editeval GET parameter, any authenticated teacher can view and change the settings—name, maximum score, and weight—of evaluation items that belong to other courses. This bug can compromise the integrity of grading data and undermine course evaluation accuracy.

The flaw exists in all Chamilo LMS installations running versions prior to 1.11.38 for the stable line and before 2.0.0‑RC.3 for the release candidate line. Only the Chamilo LMS product (chapmo:chamilo‑lms) is affected.

With a CVSS score of 7.1, the vulnerability offers a moderate to high severity level. No EPSS score is available and the issue is not listed in the CISA KEV catalog. Exploitation requires the attacker to be an authenticated teacher; the attack vector is local: manipulation of a browser URL or form submission. Successful exploitation results in unauthorized modification of evaluation parameters, potentially altering grade calculations for students in other courses.