CVE-2026-33706

Chamilo LMS is a learning management system. Prior to 1.11.38, any authenticated user with a REST API key can modify their own status field via the update_user_from_username endpoint. A student (status=5) can change their status to Teacher/CourseManager (status=1), gaining course creation and management privileges. This vulnerability is fixed in 1.11.38.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/chamilo/chamilo-lms/commit/0acf8a196307c66c049f97f5ff76cf21c4a08127	Patch
https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-3gqc-xr75-pcpw	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Chamilo LMS es un sistema de gestión del aprendizaje. Antes de la versión 1.11.38, cualquier usuario autenticado con una clave de API REST puede modificar su propio campo de estado a través del endpoint update_user_from_username. Un estudiante (estado=5) puede cambiar su estado a Profesor/Gestor de Curso (estado=1), obteniendo privilegios de creación y gestión de cursos. Esta vulnerabilidad está corregida en la versión 1.11.38.

Information

Published : 2026-04-10 19:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-33706

Mitre link : CVE-2026-33706

CVE.ORG link : CVE-2026-33706

JSON object : View

Products Affected

chamilo

chamilo_lms

CWE

CWE-269

Improper Privilege Management

{"id": "CVE-2026-33706", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33706", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T14:01:58.335604Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "chamilo", "product": "chamilo-lms", "versions": [{"status": "affected", "version": "< 1.11.38"}]}]}], "published": "2026-04-10T19:16:23.800", "references": [{"url": "https://github.com/chamilo/chamilo-lms/commit/0acf8a196307c66c049f97f5ff76cf21c4a08127", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-3gqc-xr75-pcpw", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "Chamilo LMS is a learning management system. Prior to 1.11.38, any authenticated user with a REST API key can modify their own status field via the update_user_from_username endpoint. A student (status=5) can change their status to Teacher/CourseManager (status=1), gaining course creation and management privileges. This vulnerability is fixed in 1.11.38."}, {"lang": "es", "value": "Chamilo LMS es un sistema de gesti\u00f3n del aprendizaje. Antes de la versi\u00f3n 1.11.38, cualquier usuario autenticado con una clave de API REST puede modificar su propio campo de estado a trav\u00e9s del endpoint update_user_from_username. Un estudiante (estado=5) puede cambiar su estado a Profesor/Gestor de Curso (estado=1), obteniendo privilegios de creaci\u00f3n y gesti\u00f3n de cursos. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.11.38."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A4D0C5D2-6FA0-4532-8E3D-4EA111A50621", "versionEndExcluding": "1.11.38"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}