What happened
Seed-verified (published Oct 21): the AI grading controller endpoint performs no ownership check, allowing any authenticated user to obtain AI grading of other students' attempts.
Why it matters
AI-assisted grading is a growing LMS feature; missing per-attempt authorization lets students read/tamper with others' AI-graded results at scale by enumeration.
Attack vector
Authenticated user sends requests to the open_answer_grade endpoint with target exeId/questionId, which lacks authorization checks for the exam attempt owner; AI grading results for other students are returned/applied.
Affected systems
Chamilo LMS 2.0.0-alpha.4 – < 2.0.0-RC.3 (AiController::openAnswerGrade)
Mitigation
Upgrade to Chamilo 2.0.0-RC.3+ or apply the authorization check in AiController::openAnswerGrade.