What is the CVSS score of CVE-2026-33706?

CVE-2026-33706 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Chamilo Lms are affected by CVE-2026-33706?

Chamilo LMS versions before 1.11.38 contain a privilege escalation vulnerability allowing authenticated users to self-promote from student to teacher status via REST API manipulation, enabling…. A patch is available.

How to fix or mitigate CVE-2026-33706?

Within 24 hours: Identify all Chamilo LMS deployments and confirm versions below 1.11.38. Within 7 days: Apply vendor patch to upgrade Chamilo to version 1.11.38 or later; audit REST API key distribution and revoke unnecessary keys from student accounts. Within 30 days: Review audit logs for suspicious status changes via update_user_from_username endpoint (2+ months prior) and verify no unauthorized courses were created; enforce role-based access controls limiting REST API key issuance to administrative users only.

Chamilo Lms CVE-2026-33706

EUVD-2026-21559 HIGH

Improper Privilege Management (CWE-269)

2026-04-10 security-advisories@github.com

Privilege Escalation Chamilo Lms

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 18:37 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:58 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.11.38

EUVD ID Assigned

Apr 10, 2026 - 19:22 euvd

EUVD-2026-21559

Analysis Generated

Apr 10, 2026 - 19:22 vuln.today

CVE Published

Apr 10, 2026 - 19:16 nvd

HIGH 7.1

DescriptionGitHub Advisory

Chamilo LMS is a learning management system. Prior to 1.11.38, any authenticated user with a REST API key can modify their own status field via the update_user_from_username endpoint. A student (status=5) can change their status to Teacher/CourseManager (status=1), gaining course creation and management privileges. This vulnerability is fixed in 1.11.38.

AnalysisAI

Privilege escalation in Chamilo LMS versions prior to 1.11.38 allows any authenticated user with a REST API key to elevate their account status from student (status=5) to teacher/course manager (status=1) by manipulating the status field through the update_user_from_username REST API endpoint. This enables unauthorized course creation and management capabilities. Authentication is required (PR:L), but once exploited, attackers gain high-integrity administrative functions within the learning management system. No public exploit identified at time of analysis.

Technical ContextAI

Root cause is improper privilege management (CWE-269) in the REST API's update_user_from_username endpoint. The API fails to validate whether the authenticated user has authorization to modify sensitive account attributes like the status field, allowing low-privileged users to perform status-changing operations reserved for administrators. Network-accessible (AV:N) with low attack complexity (AC:L).

RemediationAI

Vendor-released patch: upgrade to Chamilo LMS version 1.11.38 or later, which implements proper authorization checks on the update_user_from_username endpoint to prevent unauthorized status field modifications. The fix is available via commit 0acf8a196307c66c049f97f5ff76cf21c4a08127. Until patching, disable REST API access for untrusted users or revoke all student-level API keys. Review audit logs for unauthorized status changes (student accounts elevated to status=1). Official advisory: https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-3gqc-xr75-pcpw. Verify no privilege escalation has occurred before applying the patch by auditing user status fields in the database.