What is the CVSS score of CVE-2026-33708?

CVE-2026-33708 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-33708?

Yes, a patch is available for CVE-2026-33708. Update the affected software to the latest version immediately.

Chamilo Lms CVE-2026-33708

EUVD-2026-21563 MEDIUM

Missing Authorization (CWE-862)

2026-04-10 security-advisories@github.com

Authentication Bypass Chamilo Lms

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

1.11.38

EUVD ID Assigned

Apr 10, 2026 - 19:22 euvd

EUVD-2026-21563

Analysis Generated

Apr 10, 2026 - 19:22 vuln.today

CVE Published

Apr 10, 2026 - 19:16 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

Chamilo LMS is a learning management system. Prior to 1.11.38, the get_user_info_from_username REST API endpoint returns personal information (email, first name, last name, user ID, active status) of any user to any authenticated user, including students. There is no authorization check. This vulnerability is fixed in 1.11.38.

AnalysisAI

Chamilo LMS REST API endpoint get_user_info_from_username fails to authorize requests, exposing personal information (email, names, user ID, active status) to any authenticated user regardless of role prior to version 1.11.38. An attacker with valid login credentials, including a student account, can enumerate and retrieve sensitive user data for any account in the system.

Technical ContextAI

The vulnerability resides in the REST API implementation of Chamilo LMS, specifically in the get_user_info_from_username endpoint. The flaw is a missing authorization check (CWE-862: Missing Authorization) that allows the endpoint to return personally identifiable information without verifying whether the requesting user has legitimate access to view that data. While the endpoint requires authentication (PR:L per CVSS vector), it performs no role-based or attribute-based access control to limit data exposure. The vulnerability affects Chamilo LMS versions prior to 1.11.38, as indicated in the GitHub commit and security advisory.

RemediationAI

Upgrade Chamilo LMS to version 1.11.38 or later immediately. This version includes the authorization fix that adds proper access control checks to the get_user_info_from_username REST API endpoint. Follow the official Chamilo LMS upgrade documentation at https://github.com/chamilo/chamilo-lms to ensure a clean transition. Until upgrade is possible, restrict API access at the network layer (firewall rules, WAF policies) to limit exposure to REST endpoints from untrusted networks, though this does not fully mitigate the vulnerability since internal or student users can still abuse the endpoint. Review API audit logs for suspicious get_user_info_from_username calls and monitor for unauthorized enumeration activity.