Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the /social-network/personal-data/{userId} endpoint allows any authenticated user to access full personal data and API tokens of arbitrary users by modifying the userId parameter. This results in mass disclosure of sensitive user information and credentials, enabling a full platform data breach. This vulnerability is fixed in 2.0.0-RC.3.
References
| Link | Resource |
|---|---|
| https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-27x6-c5c7-gpf5 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
16 Apr 2026, 18:48
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| References | () https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-27x6-c5c7-gpf5 - Vendor Advisory | |
| CPE | cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha2:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha3:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha1:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha5:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta1:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha4:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta2:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc1:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc2:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta3:*:*:*:*:*:* |
|
| First Time |
Chamilo chamilo Lms
Chamilo |
10 Apr 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-10 19:16
Updated : 2026-04-16 18:48
NVD link : CVE-2026-33703
Mitre link : CVE-2026-33703
CVE.ORG link : CVE-2026-33703
JSON object : View
Products Affected
chamilo
- chamilo_lms
CWE
CWE-639
Authorization Bypass Through User-Controlled Key