Chamilo Lms CVE-2026-33736

CVSS 6.5 (Medium) with network-accessible API endpoint and low attack complexity reflects the moderate real-world risk. The vulnerability requires authentication (PR:L in CVSS vector), eliminating purely anonymous attacks but affecting all legitimate users including students. The high confidentiality impact (C:H) and lack of integrity/availability compromise make this a reconnaissance and social engineering enabler rather than a system takeover vector. Exploitation is straightforward for any authenticated user without special privileges; EPSS would likely rate this as moderate to high probability given the trivial attack method. SSVC assessment: exploitation is straightforward and automated (enumeration via API), technical impact is limited to information disclosure with no direct damage to system function, and automatable response is possible (API rate limiting, access controls). The confirmed fix availability in a release candidate (2.0.0-RC.3) reduces urgency slightly compared to major version releases, but installations running pre-RC.3 versions face immediate risk.

An attacker gains legitimate student credentials (via phishing, credential stuffing, or account sharing) and authenticates to a Chamilo LMS instance. The attacker then makes simple GET requests to /api/users, receiving a JSON response containing email addresses, phone numbers, and role information for all platform users including administrators. The attacker uses this information to identify high-value targets (administrator accounts, faculty) for follow-up spear-phishing campaigns or social engineering attacks targeting specific individuals by name and role. No special exploit code is required; standard HTTP client tools suffice.