Chamilo Lms CVE-2026-40291

Chamilo LMS versions prior to 2.0.0-RC.3. Attacker must be authenticated with ROLE_STUDENT role. Exploit targets the PUT /api/users/{id} endpoint by modifying the roles field in request to set ROLE_ADMIN. No victim interaction required.

This vulnerability presents extremely high real-world risk despite requiring authentication (PR:L). The CVSS v3.1 score of 8.8 accurately reflects the severe impact: network-accessible (AV:N), low complexity (AC:L), no user interaction (UI:N), and high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). While EPSS data is not provided, the combination of low attack complexity and devastating impact (full administrative takeover) makes this a priority-one remediation target for any organization running affected Chamilo versions. The attack requires only legitimate student account credentials-a low barrier in educational environments where user registration may be open or loosely controlled. Although no public exploit code exists and CISA KEV does not list active exploitation, the technical simplicity means proof-of-concept development would be trivial (a single authenticated HTTP PUT request with modified JSON payload). SSVC analysis indicates high technical impact (total control), easily automatable exploitation, and while not actively exploited, the vulnerability's disclosure increases exploitation probability. Organizations should treat this as an emergency patch situation for any internet-facing Chamilo instances, particularly those with open enrollment or untrusted student populations.

A malicious student with valid credentials authenticates to a Chamilo LMS instance and identifies their user ID (available through their profile or session data). The attacker crafts an HTTP PUT request to /api/users/{their_id} with a JSON payload containing their modified user data, crucially setting the roles field to include ROLE_ADMIN. The inadequate authorization check validates only that the user owns the record being modified, not whether they have permission to change security-critical fields, allowing the request to succeed. The student account is immediately elevated to administrator, granting unrestricted access to all courses, the ability to view and modify grades for all students, access to personally identifiable information of all users, and control over system configuration.