PT-2026-23633 · Chamilo · Chamilo

Published 2026-03-06 · Updated 2026-03-06 · CVE-2025-59544

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.34

Description Chamilo is a learning management system. A flaw exists in the user category update functionality where authorization checks are missing for the category id parameter. This allows users to modify the category of any user by manipulating the category id parameter. The issue was addressed in version 1.11.34.

Recommendations Update to version 1.11.34 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-59544

GHSA-X3H9-H7QF-WWRF

Affected Products

Chamilo

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59544.json · Exploit
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-x3h9-h7qf-wwrf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59544 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59544 · Security Note
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.34 · Note
• https://twitter.com/cyberbivash/status/2029803465422086491 · Twitter Post