PT-2026-32933 · Unknown · Chamilo Lms

Aastha2602 · Published 2026-04-14 · Updated 2026-04-15 · CVE-2026-34602

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions prior to 2.0.0-RC.3

Description An Insecure Direct Object Reference (IDOR) exists in the '/api/course rel users' endpoint. An authenticated attacker can modify the user parameter in the request body to enroll any arbitrary user into any course. This occurs because the backend trusts user-supplied input for the user field without server-side verification to ensure the requester has the necessary permissions to act on behalf of other users. This allows unauthorized manipulation of user-course relationships, which can lead to bypassing enrollment controls and granting unintended access to course materials.

Recommendations Update to version 2.0.0-RC.3.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-34602

Affected Products

Chamilo Lms

References · 8

• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-x373-8j9j-g5pj · Vendor Advisory
• https://github.com/chamilo/chamilo-lms/commit/c9c30cdc48afae57cd6ab012ae2eceafd351a40e · Patch
• https://github.com/chamilo/chamilo-lms/commit/2a9f060fa9d50fc9a92ed93af774d2619642df92 · Patch
• https://github.com/chamilo/chamilo-lms/commit/bd2ba34c2e74475587e38c74c90c2934e69c8779 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-34602 · Security Note
• https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3 · Note
• https://twitter.com/VulmonFeeds/status/2044310659643416977 · Twitter Post
• https://twitter.com/CVEnew/status/2044338919798702463 · Twitter Post