Which versions of Chamilo Lms are affected by CVE-2026-33703?

Chamilo LMS versions prior to 2.0.0-RC.3 contain an insecure direct object reference vulnerability that allows any authenticated user to extract personal data and API credentials of all other…. A patch is available.

How to fix or mitigate CVE-2026-33703?

Within 24 hours: Identify all Chamilo LMS instances in your environment and confirm current version against 2.0.0-RC.3 baseline. Within 7 days: Apply vendor-released patch to upgrade all affected Chamilo installations to version 2.0.0-RC.3 or later; coordinate with learning operations to schedule maintenance windows. Within 30 days: Audit API token usage logs for the past 90 days to identify any unauthorized token access; rotate all API credentials issued prior to patch deployment; implement API rate limiting and request logging on the /social-network/personal-data endpoint.

Chamilo Lms CVE-2026-33703

Q: What is the CVSS score of CVE-2026-33703?

CVE-2026-33703 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21543 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-10 GitHub_M

Authentication Bypass Chamilo Lms

7.1

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 18:52 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:58 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2.0.0-RC.3

EUVD ID Assigned

Apr 10, 2026 - 18:45 euvd

EUVD-2026-21543

Analysis Generated

Apr 10, 2026 - 18:45 vuln.today

CVE Published

Apr 10, 2026 - 18:23 nvd

HIGH 7.1

DescriptionGitHub Advisory

Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the /social-network/personal-data/{userId} endpoint allows any authenticated user to access full personal data and API tokens of arbitrary users by modifying the userId parameter. This results in mass disclosure of sensitive user information and credentials, enabling a full platform data breach. This vulnerability is fixed in 2.0.0-RC.3.

AnalysisAI

Insecure Direct Object Reference in Chamilo LMS allows authenticated users to access complete personal data and API tokens of any user by manipulating the userId parameter in the /social-network/personal-data/{userId} endpoint. Attack requires only low-privilege authentication (PR:L) and no user interaction, enabling mass disclosure of credentials and sensitive information across the entire platform. Affects all Chamilo LMS versions prior to 2.0.0-RC.3. No public exploit identified at time of analysis.

Technical ContextAI

CWE-639 (Authorization Bypass Through User-Controlled Key) flaw in social networking module fails to validate authenticated user authorization against requested userId parameter. Missing object-level access control permits horizontal privilege escalation, exposing profile data and authentication tokens through predictable numeric user identifiers. Network-accessible (AV:N), low complexity (AC:L), no attack complexity requirements (AT:N).

RemediationAI

Vendor-released patch: upgrade to Chamilo LMS version 2.0.0-RC.3 or later, which implements proper authorization checks on the social-network personal data endpoint. Organizations unable to upgrade immediately should implement network-level access controls restricting authenticated user access to the /social-network/personal-data/ endpoint, or temporarily disable the social networking module until patching is complete. Rotate all API tokens for users whose data may have been accessed. Full advisory available at https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-27x6-c5c7-gpf5