CVE-2026-34370

{"id": "CVE-2026-34370", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34370", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T18:57:17.887701Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "chamilo", "product": "chamilo-lms", "versions": [{"status": "affected", "version": "< 2.0.0-RC.3"}]}]}], "published": "2026-04-14T22:16:31.340", "references": [{"url": "https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-fm35-2hvw-564q", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-285"}, {"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the notebook module contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated student to read the private course notes of any other user on the platform by manipulating the notebook_id parameter in the editnote action. The application fetches the note content using only the supplied integer ID without verifying that the requesting user owns the note, and the full title and HTML body are rendered in the edit form and returned to the attacker's browser. While ownership checks exist in the write paths (updateNote() and delete_note()), they are entirely absent from the read path (get_note_information()). This issue has been fixed in version 2.0.0-RC.3."}, {"lang": "es", "value": "Chamilo LMS es un sistema de gesti\u00f3n de aprendizaje de c\u00f3digo abierto. En versiones anteriores a 2.0.0-RC.3, el m\u00f3dulo de cuaderno contiene una vulnerabilidad de Referencia Directa Insegura a Objeto (IDOR) que permite a cualquier estudiante autenticado leer las notas privadas del curso de cualquier otro usuario en la plataforma manipulando el par\u00e1metro notebook_id en la acci\u00f3n editnote. La aplicaci\u00f3n obtiene el contenido de la nota utilizando solo el ID entero proporcionado sin verificar que el usuario solicitante sea el propietario de la nota, y el t\u00edtulo completo y el cuerpo HTML se renderizan en el formulario de edici\u00f3n y se devuelven al navegador del atacante. Si bien existen comprobaciones de propiedad en las rutas de escritura (updateNote() y delete_note()), est\u00e1n completamente ausentes de la ruta de lectura (get_note_information()). Este problema ha sido solucionado en la versi\u00f3n 2.0.0-RC.3."}], "lastModified": "2026-07-24T22:10:00.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "34085140-9203-4B20-9036-743718F1A4F8", "versionEndIncluding": "1.11.38"}, {"criteria": "cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4AF7661F-C1F7-4CAB-BBDF-FC5BF7F5BEB8"}, {"criteria": "cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FE56AF71-9D53-42C6-980D-09E1C418ED87"}, {"criteria": "cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "01195674-9E1A-4C07-B7D3-0F0CC2E6511B"}, {"criteria": "cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BAE63449-5A56-4302-A4BF-F3D19FC96A80"}, {"criteria": "cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A84A06F9-5AB7-4703-8153-33AC68882B95"}, {"criteria": "cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B91302A3-53DE-4ED0-BAAB-FE9DA03F8242"}, {"criteria": "cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "46008D4A-96F7-4E04-8256-E115AAAE3383"}, {"criteria": "cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6E2BCAFF-D44B-4E67-998A-DF855E27606B"}, {"criteria": "cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D2E7D018-E4C2-45F5-8D9A-DAC947173607"}, {"criteria": "cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DAF96697-6B6D-459D-9510-E5CEEDC2859B"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}