CVE-2026-33736 PUBLISHED

Chamilo LMS has an Insecure Direct Object Reference (IDOR) - User Data Exposure

Assigner: GitHub_M
Reserved: 23.03.2026 Published: 10.04.2026 Updated: 10.04.2026

Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, any authenticated user (including ROLE_STUDENT) can enumerate all platform users and access personal information (email, phone, roles) via GET /api/users, including administrator accounts. This vulnerability is fixed in 2.0.0-RC.3.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS Score: 6.5

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	chamilo
Product	chamilo-lms
Versions	Version >= 2.0.0-alpha.1, < 2.0.0-RC.3 is affected

References

https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-fp2p-fj6c-x3x9
https://github.com/chamilo/chamilo-lms/commit/1739371ce1c562c007c7f5d53e6d65b7a4ff4109

Problem Types

CWE-639: Authorization Bypass Through User-Controlled Key CWE