PT-2026-32939 · Unknown · Chamilo Lms

8L4Nnk · Published 2026-04-14 · Updated 2026-04-15 · CVE-2026-40291

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions prior to 2.0.0-RC.3

Description An insecure direct object modification in the 'PUT /api/users/{id}' endpoint allows authenticated users with the ROLE STUDENT role to escalate their privileges to ROLE ADMIN. This occurs because the security expression is granted('EDIT', object) only verifies record ownership, while the roles field remains in the writable serialization group. By modifying the roles field on their own user record, an attacker can gain full administrative control of the platform, including access to all courses, user data, grades, and administrative settings.

Recommendations Update to version 2.0.0-RC.3.

Fix

Improper Privilege Management

Incorrect Authorization

Weakness Enumeration

CWE-269

CWE-863

Related Identifiers

CVE-2026-40291

Affected Products

Chamilo Lms

References · 4

• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-7phx-w897-4c9x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40291 · Security Note
• https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3 · Note
• https://twitter.com/CVEnew/status/2044338916359365003 · Twitter Post