What is the CVSS score of CVE-2026-33710?

CVE-2026-33710 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Chamilo Lms are affected by CVE-2026-33710?

Chamilo LMS versions before 1.11.38 and 2.0.0-RC.3 generate predictable API keys due to a flawed random seed implementation, allowing unauthenticated attackers to brute-force valid credentials and…. A patch is available.

How to fix or mitigate CVE-2026-33710?

Within 24 hours: Inventory all Chamilo LMS deployments and identify instances running versions prior to 1.11.38 or 2.0.0-RC.3. Within 7 days: Apply vendor-released patch to upgrade to Chamilo 1.11.38 or 2.0.0-RC.3 or later across all affected systems. Within 30 days: Audit REST API access logs for suspicious activity; rotate all existing API keys; implement rate limiting and IP whitelisting on API endpoints; and require re-authentication for sensitive operations.

Chamilo Lms CVE-2026-33710

EUVD-2026-21565 HIGH

Use of Insufficiently Random Values (CWE-330)

2026-04-10 security-advisories@github.com

Information Disclosure Chamilo Lms

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 18:37 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:58 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2.0.0-RC.3,1.11.38

EUVD ID Assigned

Apr 10, 2026 - 19:22 euvd

EUVD-2026-21565

Analysis Generated

Apr 10, 2026 - 19:22 vuln.today

CVE Published

Apr 10, 2026 - 19:16 nvd

HIGH 7.5

DescriptionGitHub Advisory

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, REST API keys are generated using md5(time() + (user_id * 5) - rand(10000, 10000)). The rand(10000, 10000) call always returns exactly 10000 (min == max), making the formula effectively md5(timestamp + user_id*5 - 10000). An attacker who knows a username and approximate key creation time can brute-force the API key. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

AnalysisAI

Predictable API key generation in Chamilo LMS versions prior to 1.11.38 and 2.0.0-RC.3 allows unauthenticated remote attackers to brute-force valid REST API keys. The md5-based generation algorithm uses a flawed random seed (rand(10000,10000) always returns 10000), reducing the keyspace to md5(timestamp + user_id*5 - 10000). Attackers with knowledge of target usernames and approximate key creation timestamps can enumerate valid API keys through offline computation, enabling unauthorized access to REST API endpoints and confidential data exposure. No public exploit identified at time of analysis.

Technical ContextAI

Root cause is CWE-330 insufficient entropy in md5-based key generation. The rand() call with identical min/max parameters eliminates randomness entirely, reducing cryptographic strength to timestamp-based deterministic output. Given timestamp granularity and small user_id search space, brute-force complexity is trivial for modern hardware, exposing all API keys generated via this mechanism.

RemediationAI

Upgrade immediately to Chamilo LMS version 1.11.38 (stable branch) or 2.0.0-RC.3 (development branch). Vendor-released patches implement cryptographically secure random number generation for API key creation. After upgrading, regenerate all existing API keys to eliminate keys created with the weak algorithm. Users unable to upgrade immediately should rotate all API keys and implement rate-limiting on API endpoints to mitigate brute-force attempts. Review access logs for unauthorized API usage. Official vendor security advisory: https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-rpmg-j327-mr39. Upstream fixes available in commits 4448701bb8ec557e94ef02d19c72cbe9c49c2d09 and e7400dd840586ae134b286d0a2374f3d269a9a9d.