PT-2026-3374 · Unknown · Chamilo Lms

Angelkate · Publicado 2026-01-18 · Atualizado 2026-01-18 · CVE-2026-1106

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions up to 2.0.0 Beta 1

Description A security flaw exists in Chamilo LMS that allows for remote unauthorized access due to improper authorization. The issue is located within the deleteLegal function of the Legal Consent Handler component, specifically in the file src/CoreBundle/Controller/SocialController.php. Manipulation of the userId argument can lead to unauthorized actions. The exploit for this issue has been publicly released.

Recommendations Versions prior to 2.0.0 Beta 1 should be used. As a temporary workaround, consider restricting access to the deleteLegal() function until a patch is available.

Exploit

Correção

Improper Authorization

Incorrect Privilege Assignment

Enumeração de Fraquezas

CWE-285

CWE-266

Identificadores relacionados

CVE-2026-1106

Produtos afetados

Chamilo Lms

Referências · 8

• 🔥 https://note-hxlab.wetolink.com/share/w92t1Q0a74Gj · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-1106 · Nota de Segurança
• https://vuldb.com/?id.341698 · Nota
• https://twitter.com/VulmonFeeds/status/2012704400448381333 · Publicação no Twitter
• https://vuldb.com/?ctiid.341698 · Nota
• https://twitter.com/CVEnew/status/2012763620082700561 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-1106 · Aviso do Fabricante
• https://vuldb.com/?submit.731510 · Nota