Chamilo LMS CVE-2026-114390

Exploitable only against Chamilo LMS 2.0.0-alpha.1 up to (not including) 2.0.0-RC.3, where the legacy AJAX handlers in public/main/inc/ajax/ (course.ajax.php, usergroup.ajax.php, gradebook.ajax.php, user_manager.ajax.php, online.ajax.php) ship without role checks on actions like get_users_by_group_course, user_by_all_roles, and export_all_certificates. No special feature toggle or non-default configuration is required - these endpoints are reachable by unauthenticated or low-privileged users in a default install. Limiting factors: the affected range is entirely pre-release (alpha/RC), so stable 1.x production sites are unaffected; impact is confined to disclosure of learner names and certificate PDFs with no write/modify or availability impact; and upgrading to v2.0.0-RC.3 (which adds the authorization guards) fully remediates.

This is a genuine but moderate-severity information-disclosure issue, not a critical system-compromise bug. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) is internally consistent with the description: network-reachable, low-complexity, no privileges or user interaction required, with low confidentiality impact and zero integrity/availability impact - matching a missing-authorization (CWE-862) flaw that leaks names and certificate PDFs rather than enabling code execution or data modification. The confidentiality impact is rated Low because the exposed data (learner names, certificate PDFs) is sensitive PII but not credentials or secrets. No EPSS score was provided, the CVE is NOT in CISA KEV, and no public POC was supplied, so there is no public exploit identified at time of analysis; the SSVC framework cannot be fully applied as no exploitation-status/automatable decision data was given. The single most important limiting signal, which the raw severity obscures, is that the affected range is strictly pre-release (2.0.0-alpha.1 through 2.0.0-RC.2); stable production Chamilo deployments run the 1.x line and are not in scope, sharply reducing real-world exposure. Net: a legitimate, easy-to-trigger PII leak that warrants patching for anyone running the 2.0 release candidates, but low urgency absent active exploitation and given the narrow pre-release footprint.

An unauthenticated attacker sends crafted HTTP requests directly to legacy AJAX endpoints under public/main/inc/ajax/ (e.g. invoking actions such as get_users_by_group_course, user_by_all_roles, or export_all_certificates) which lacked authorization checks. Because no privileges or user interaction are required (PR:N/UI:N), the attacker enumerates learner names and downloads other users' certificate PDFs at scale. No public exploit code was identified at time of analysis, but the attack is trivial to reproduce from the fix diff.