PT-2026-32023 · Unknown · Chamilo Lms

CVE-2026-33708 · Published 2026-04-10 · Updated 2026-04-10

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions prior to 1.11.38

Description Chamilo LMS is a learning management system. The get user info from username API endpoint ('/get user info from username') does not perform authorization checks, allowing any authenticated user to retrieve personal information (email, first name, last name, user ID, active status) of any other user. The vulnerable parameter is the username.

Recommendations Update to version 1.11.38 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-33708

GHSA-QWCH-82Q9-Q999

Affected Products

Chamilo Lms

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33708.json · Exploit
• https://github.com/chamilo/chamilo-lms/commit/4a119f93abbfba6fe833580f2463c8d4afa500c2 · Patch
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-qwch-82q9-q999 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33708 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33708 · Security Note
• https://twitter.com/VulmonFeeds/status/2042748687344955466 · Twitter Post
• https://twitter.com/CVEnew/status/2042710192484188442 · Twitter Post