CVE-2026-33708

Chamilo LMS is a learning management system. Prior to 1.11.38, the get_user_info_from_username REST API endpoint returns personal information (email, first name, last name, user ID, active status) of any user to any authenticated user, including students. There is no authorization check. This vulnerability is fixed in 1.11.38.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/chamilo/chamilo-lms/commit/4a119f93abbfba6fe833580f2463c8d4afa500c2	Patch
https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-qwch-82q9-q999	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Chamilo LMS es un sistema de gestión del aprendizaje. Antes de la versión 1.11.38, el endpoint de la API REST get_user_info_from_username devuelve información personal (correo electrónico, nombre, apellido, ID de usuario, estado activo) de cualquier usuario a cualquier usuario autenticado, incluidos los estudiantes. No hay verificación de autorización. Esta vulnerabilidad se corrigió en la versión 1.11.38.

Information

Published : 2026-04-10 19:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-33708

Mitre link : CVE-2026-33708

CVE.ORG link : CVE-2026-33708

JSON object : View

Products Affected

chamilo

chamilo_lms

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-33708", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33708", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T15:03:48.949171Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "chamilo", "product": "chamilo-lms", "versions": [{"status": "affected", "version": "< 1.11.38"}]}]}], "published": "2026-04-10T19:16:24.107", "references": [{"url": "https://github.com/chamilo/chamilo-lms/commit/4a119f93abbfba6fe833580f2463c8d4afa500c2", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-qwch-82q9-q999", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Chamilo LMS is a learning management system. Prior to 1.11.38, the get_user_info_from_username REST API endpoint returns personal information (email, first name, last name, user ID, active status) of any user to any authenticated user, including students. There is no authorization check. This vulnerability is fixed in 1.11.38."}, {"lang": "es", "value": "Chamilo LMS es un sistema de gesti\u00f3n del aprendizaje. Antes de la versi\u00f3n 1.11.38, el endpoint de la API REST get_user_info_from_username devuelve informaci\u00f3n personal (correo electr\u00f3nico, nombre, apellido, ID de usuario, estado activo) de cualquier usuario a cualquier usuario autenticado, incluidos los estudiantes. No hay verificaci\u00f3n de autorizaci\u00f3n. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 1.11.38."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A4D0C5D2-6FA0-4532-8E3D-4EA111A50621", "versionEndExcluding": "1.11.38"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}