PT-2026-3374 · Unknown · Chamilo Lms

Angelkate · Published 2026-01-18 · Updated 2026-01-18 · CVE-2026-1106

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions up to 2.0.0 Beta 1

Description A security flaw exists in Chamilo LMS that allows for remote unauthorized access due to improper authorization. The issue is located within the deleteLegal function of the Legal Consent Handler component, specifically in the file src/CoreBundle/Controller/SocialController.php. Manipulation of the userId argument can lead to unauthorized actions. The exploit for this issue has been publicly released.

Recommendations Versions prior to 2.0.0 Beta 1 should be used. As a temporary workaround, consider restricting access to the deleteLegal() function until a patch is available.

Exploit

Fix

Improper Authorization

Incorrect Privilege Assignment

Weakness Enumeration

CWE-285

CWE-266

Related Identifiers

CVE-2026-1106

Affected Products

Chamilo Lms

References · 8

• 🔥 https://note-hxlab.wetolink.com/share/w92t1Q0a74Gj · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-1106 · Security Note
• https://osv.dev/vulnerability/CVE-2026-1106 · Vendor Advisory
• https://vuldb.com/?id.341698 · Note
• https://twitter.com/VulmonFeeds/status/2012704400448381333 · Twitter Post
• https://vuldb.com/?ctiid.341698 · Note
• https://twitter.com/CVEnew/status/2012763620082700561 · Twitter Post
• https://vuldb.com/?submit.731510 · Note