Authenticated remote code execution in Chamilo LMS (CVE-2026-34239)

An insufficient access control vulnerability in Chamilo LMS allows any authenticated user enrolled in a course (student, teacher, or DRH) to reach the `main/inc/ajax/lang.ajax.php` endpoint (`translate_portfolio_category` action), which is protected only by `api_protect_course_script(true)` with no admin check. Successful exploitation enables remote code execution with high impact on confidentiality, integrity, and availability of the vulnerable system. Affected versions: - <=1.11.40 We recommend updating to: 1.11.40. CVSS 7.5 · our assessment: this_week Reference: https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-4hwq-pv7c-3928 Details: https://vuln.today/cve/CVE-2026-34239