PT-2026-32023 · Chamilo · Chamilo Lms

Published 2026-04-10 · Updated 2026-04-10 · CVE-2026-33708

Mitre

CVSS v3.1

6.5

Medium

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Chamilo LMS is a learning management system. Prior to 1.11.38, the get user info from username REST API endpoint returns personal information (email, first name, last name, user ID, active status) of any user to any authenticated user, including students. There is no authorization check. This vulnerability is fixed in 1.11.38.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-33708

Affected Products

Chamilo Lms

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-33708 · Security Note
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-qwch-82q9-q999 · Note
• https://github.com/chamilo/chamilo-lms/commit/4a119f93abbfba6fe833580f2463c8d4afa500c2 · Note