What is the CVSS score of CVE-2026-33141?

CVE-2026-33141 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-33141?

Yes, a patch is available for CVE-2026-33141. Update the affected software to the latest version immediately.

Chamilo Lms CVE-2026-33141

EUVD-2026-21535 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-10 security-advisories@github.com

Authentication Bypass Chamilo Lms

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2.0.0-RC.3

EUVD ID Assigned

Apr 10, 2026 - 18:22 euvd

EUVD-2026-21535

Analysis Generated

Apr 10, 2026 - 18:22 vuln.today

CVE Published

Apr 10, 2026 - 18:16 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the REST API stats endpoint allows any authenticated user (including low-privilege students with ROLE_USER) to read any other user's learning progress, certificates, and gradebook scores for any course, without enrollment or supervisory relationship. This vulnerability is fixed in 2.0.0-RC.3.

AnalysisAI

Insecure Direct Object Reference in Chamilo LMS REST API stats endpoint allows authenticated low-privilege users to read unauthorized access to any user's learning progress, certificates, and gradebook scores across all courses prior to version 2.0.0-RC.3. The vulnerability requires only valid user credentials (accessible to students with ROLE_USER) and network access, enabling horizontal privilege escalation without administrative intervention or system compromise. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

Chamilo LMS implements a REST API endpoint for retrieving statistics and academic records. The stats endpoint fails to enforce proper authorization checks at the object level, implementing only authentication (user login requirement) without verifying that the requesting user has legitimate access to the specific user record or course enrollment being queried. This is classified as Insecure Direct Object Reference (CWE-639: Authorization Through User-Controlled Key), where the API accepts user-supplied identifiers (user IDs, course IDs) without validating the requester's relationship to those resources. Any authenticated user can manipulate API request parameters to enumerate and retrieve learning progress data, certificate status, and gradebook entries belonging to other users. The vulnerability exists in versions prior to 2.0.0-RC.3 and affects the REST API authentication layer rather than the core LMS application.

RemediationAI

Upgrade Chamilo LMS to version 2.0.0-RC.3 or later immediately. The upstream fix was applied via commit 792ba05953470ca971617fe2674ed14c1479fa80 and is included in the patched release. Organizations unable to upgrade immediately should restrict REST API access at the application or network level, disable the stats endpoint if not critical to operations, or implement additional authorization checks in API middleware to verify user enrollment or supervisory relationship before serving academic records. Review API access logs for anomalous patterns of cross-user data requests. See https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-j2pr-2r5w-jrpj for complete remediation guidance and configuration recommendations.