PT-2026-23633 · Chamilo · Chamilo

CVE-2025-59544 · Publicado 2026-03-06 · Atualizado 2026-03-06

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.34

Description Chamilo is a learning management system. A flaw exists in the user category update functionality where authorization checks are missing for the category id parameter. This allows users to modify the category of any user by manipulating the category id parameter. The issue was addressed in version 1.11.34.

Recommendations Update to version 1.11.34 or later.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-59544

GHSA-X3H9-H7QF-WWRF

Produtos afetados

Chamilo

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59544.json · Exploit
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.34 · Nota
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-x3h9-h7qf-wwrf · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2025-59544 · Aviso do Fabricante
• https://twitter.com/cyberbivash/status/2029803465422086491 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-59544 · Nota de Segurança