CVE-2026-33736: Chamilo LMS has an Insecure Direct Object Reference (IDOR) - User Data Exposure

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-10 · updated 2026-10-26
Weakness: CWE-639

Description

Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, any authenticated user (including ROLE_STUDENT) can enumerate all platform users and access personal information (email, phone, roles) via GET /api/users, including administrator accounts. This vulnerability is fixed in 2.0.0-RC.3.

Affected products

chamilo-lms: 2.0.0-alpha1, 2.0.0-alpha2, 2.0.0-alpha3, 2.0.0-alpha4, 2.0.0-alpha5, 2.0.0-beta1 (+4)

References

https://github.com/chamilo/chamilo-lms/commit/1739371ce1c562c007c7f5d53e6d65b7a4ff4109
https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-fp2p-fj6c-x3x9

Get alerted when CVE-2026-33736 or the next vulnerability affects your stack