What is the CVSS score of CVE-2026-33702?

CVE-2026-33702 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-33702?

Chamilo LMS versions prior to 1.11.38 and 2.0.0-RC.3 contain an insecure direct object reference vulnerability that allows enrolled students to fraudulently modify course progress records for other…. A patch is available.

How to fix or mitigate CVE-2026-33702?

Within 24 hours: Identify all Chamilo LMS instances and document current versions. Within 7 days: Upgrade Chamilo to version 1.11.38 or later (or 2.0.0-RC.3 or later for v2 deployments). Within 30 days: Conduct audit of Learning Path progress records for the past 90 days to detect unauthorized modifications; implement access logging for the lp_ajax_save_item.php endpoint and cross-reference with enrollment validation.

PHP CVE-2026-33702

EUVD-2026-21541 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-10 GitHub_M

PHP Authentication Bypass

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 18:52 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:58 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2.0.0-RC.3,1.11.38

EUVD ID Assigned

Apr 10, 2026 - 18:45 euvd

EUVD-2026-21541

Analysis Generated

Apr 10, 2026 - 18:45 vuln.today

CVE Published

Apr 10, 2026 - 18:15 nvd

HIGH 7.1

DescriptionGitHub Advisory

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains an Insecure Direct Object Reference (IDOR) vulnerability in the Learning Path progress saving endpoint. The file lp_ajax_save_item.php accepts a uid (user ID) parameter directly from $_REQUEST and uses it to load and modify another user's Learning Path progress - including score, status, completion, and time - without verifying that the requesting user matches the target user ID. Any authenticated user enrolled in a course can overwrite another user's Learning Path progress by simply changing the uid parameter in the request. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

AnalysisAI

Insecure Direct Object Reference in Chamilo LMS versions prior to 1.11.38 and 2.0.0-RC.3 allows authenticated users enrolled in a course to manipulate arbitrary Learning Path progress data for other users. The lp_ajax_save_item.php endpoint accepts a uid parameter without ownership validation, enabling attackers to overwrite scores, completion status, and time tracking for any enrolled user by modifying the request parameter. No public exploit identified at time of analysis. CVSS 7.1 (High) reflects authenticated network-based exploitation with high integrity impact.

Technical ContextAI

CWE-639 authorization bypass via user-controlled key. The vulnerable PHP endpoint (lp_ajax_save_item.php) extracts uid from $_REQUEST superglobal and directly applies it to database operations modifying learning_path_item_view records without session-to-uid ownership verification. Affects chamilo:chamilo-lms versions preceding 1.11.38 (stable) and 2.0.0-RC.3 (development branch). CVSS PR:L confirms authenticated context required.

RemediationAI

Vendor-released patch: upgrade to Chamilo LMS 1.11.38 (stable) or 2.0.0-RC.3 (development). Official security advisory and patched code available at https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-3rv7-9fhx-j654. Commits 6331d051b4468deb5830c01d1e047c5e5cf2c74f and bf3f6c6949b5c882b48a9914baa19910417e4551 implement server-side validation ensuring uid parameter matches authenticated session user before processing Learning Path modifications. No workaround exists; immediate upgrade required for production deployments. Restrict course enrollment permissions and audit Learning Path records for anomalous progress modifications as interim detective control.