PT-2026-22616 · Chamilo · Chamilo

Published 2026-03-02 · Updated 2026-03-07 · CVE-2025-52469

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.30

Description Chamilo is a learning management system. A logic issue in the friend request workflow of Chamilo’s social network module allows an authenticated user to add any user as a friend by directly calling an AJAX endpoint. The attacker bypasses the normal friend request process, and can even add non-existent users. This breaks access control and social interaction logic, potentially impacting privacy. The vulnerable endpoint is an AJAX endpoint used for managing friend requests. The issue is exploitable by any authenticated user, allowing them to manipulate the friend request workflow.

Recommendations Update to version 1.11.30 or later.

Exploit

Fix

Weakness Enumeration

CWE-841

Related Identifiers

CVE-2025-52469

GHSA-M5XJ-5XF3-RQCH

Affected Products

Chamilo

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52469.json · Exploit
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-m5xj-5xf3-rqch · Vendor Advisory
• https://github.com/chamilo/chamilo-lms/commit/39e0fa88a2ba5dd197e0d8ce7335730b666992a6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-52469 · Security Note
• https://osv.dev/vulnerability/CVE-2025-52469 · Vendor Advisory
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30 · Note
• https://twitter.com/cracbot/status/2030237135169831023 · Twitter Post
• https://twitter.com/cracbot/status/2029512380498206847 · Twitter Post
• https://twitter.com/cracbot/status/2029874840124149886 · Twitter Post