PT-2026-32023 · Unknown · Chamilo Lms

Published 2026-04-10 · Updated 2026-04-10 · CVE-2026-33708

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions prior to 1.11.38

Description Chamilo LMS is a learning management system. The get user info from username API endpoint ('/get user info from username') does not perform authorization checks, allowing any authenticated user to retrieve personal information (email, first name, last name, user ID, active status) of any other user. The vulnerable parameter is the username.

Recommendations Update to version 1.11.38 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-33708

Affected Products

Chamilo Lms

References · 5

• https://github.com/chamilo/chamilo-lms/commit/4a119f93abbfba6fe833580f2463c8d4afa500c2 · Patch
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-qwch-82q9-q999 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33708 · Security Note
• https://twitter.com/CVEnew/status/2042710192484188442 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2042748687344955466 · Twitter Post