PT-2026-32015 · Unknown · Chamilo Lms

Published 2026-04-10 · Updated 2026-04-11 · CVE-2026-33702

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions prior to 1.11.38 and prior to 2.0.0-RC.3

Description Chamilo LMS contains an Insecure Direct Object Reference (IDOR) vulnerability in the Learning Path progress saving endpoint. The lp ajax save item.php file accepts a uid parameter directly from the request and uses it to load and modify another user's Learning Path progress – including score, status, completion, and time – without verifying that the requesting user matches the target user ID. Any authenticated user enrolled in a course can overwrite another user's Learning Path progress by changing the uid parameter in the request.

Recommendations Update to Chamilo LMS version 1.11.38 or later. Update to Chamilo LMS version 2.0.0-RC.3 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-33702

Affected Products

Chamilo Lms

References · 6

• 🔥 https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-3rv7-9fhx-j654 · Exploit
• https://github.com/chamilo/chamilo-lms/commit/6331d051b4468deb5830c01d1e047c5e5cf2c74f · Patch
• https://github.com/chamilo/chamilo-lms/commit/bf3f6c6949b5c882b48a9914baa19910417e4551 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-33702 · Security Note
• https://twitter.com/CVEnew/status/2042710200499544117 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2042764045963390996 · Twitter Post