An issue was discovered in Chamillo LMS 1.11.2. The Social Network /personal_data endpoint exposes full sensitive user information even after logout because proper cache-control is missing. Using the browser back button restores all personal data, allowing unauthorized users on the same device to view confidential information. This leads to profiling, impersonation, targeted attacks, and significant privacy risks.
References
| Link | Resource |
|---|---|
| https://github.com/Rivek619/CVE-2025-69581 | Third Party Advisory Exploit |
| https://github.com/chamilo/chamilo-lms | Product |
Configurations
History
05 Feb 2026, 21:46
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:chamilo:chamilo_lms:1.11.2:*:*:*:*:*:*:* | |
| References | () https://github.com/Rivek619/CVE-2025-69581 - Third Party Advisory, Exploit | |
| References | () https://github.com/chamilo/chamilo-lms - Product | |
| First Time |
Chamilo chamilo Lms
Chamilo |
20 Jan 2026, 15:20
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| CWE | CWE-524 |
16 Jan 2026, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CWE | CWE-200 |
16 Jan 2026, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-16 20:15
Updated : 2026-02-05 21:46
NVD link : CVE-2025-69581
Mitre link : CVE-2025-69581
CVE.ORG link : CVE-2025-69581
JSON object : View
Products Affected
chamilo
- chamilo_lms
CWE
CWE-524
Use of Cache Containing Sensitive Information