CVE-2026-33703

EUVD-2026-21543

10.04.2026, 19:16

Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the /social-network/personal-data/{userId} endpoint allows any authenticated user to access full personal data and API tokens of arbitrary users by modifying the userId parameter. This results in mass disclosure of sensitive user information and credentials, enabling a full platform data breach. This vulnerability is fixed in 2.0.0-RC.3.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.5 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 10%

Affected Products (NVD)

Vendor	Product	Version
chamilo	chamilo_lms	2.0.0:alpha1
chamilo	chamilo_lms	2.0.0:alpha2
chamilo	chamilo_lms	2.0.0:alpha3
chamilo	chamilo_lms	2.0.0:alpha4
chamilo	chamilo_lms	2.0.0:alpha5
chamilo	chamilo_lms	2.0.0:beta1
chamilo	chamilo_lms	2.0.0:beta2
chamilo	chamilo_lms	2.0.0:beta3
chamilo	chamilo_lms	2.0.0:rc1
chamilo	chamilo_lms	2.0.0:rc2

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-639 - Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References

https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-27x6-c5c7-gpf5