What’s Vulnerable › Vulnerabilities

CVE-2026-33707: Weak Password Recovery Mechanism for Forgotten Password in chamilo/chamilo-lms

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-10 · updated 2026-10-26
• Weakness: CWE-640

Description

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, the default password reset mechanism generates tokens using sha1($email) with no random component, no expiration, and no rate limiting. An attacker who knows a user's email can compute the reset token and change the victim's password without authentication. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

Affected products

• chamilo-lms: before 1.11.38; 2.0.0-alpha1, 2.0.0-alpha2, 2.0.0-alpha3, 2.0.0-alpha4, 2.0.0-alpha5, 2.0.0-beta1 (+4) — fixed in 1.11.38

How to fix

Upgrade to a fixed version: chamilo-lms 1.11.38. Check the vendor advisory for mitigations.

References

• https://github.com/chamilo/chamilo-lms/commit/078d7e5b77679fa7ccfcd6783bd5cc683db0bda8
• https://github.com/chamilo/chamilo-lms/commit/750a45312a0d5c3ad60dbfbd0d959ca40be4a18c
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-f27g-66gq-g7v2

Get alerted when CVE-2026-33707 or the next vulnerability affects your stack