Chamilo LMS CVE-2026-45141

Exploitation requires that a victim who is an authenticated Chamilo administrator or DRH, with a valid active session, visit an attacker-controlled page while logged in; the attacker needs no account or credentials of their own. The specific precondition that makes it work is the absence of a Security::check_token() call on the add, delete_gradebook_from_skill, save_profile, and delete_profile actions in public/main/inc/ajax/skill.ajax.php in version 2.0.0. Limiting factors that reduce real-world risk: it only affects privileged users (admin or DRH), it depends on user interaction (the victim must open the malicious page during an active session), and it is closed entirely by upgrading to 2.0.1, which the vendor provides as the fix.

This is a CWE-352 cross-site request forgery flaw rated CVSS 6.5 (medium). The supplied vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N shows a network, low-complexity attack that needs no attacker privileges but DOES require user interaction (UI:R) - specifically that a logged-in administrator or DRH visit an attacker-controlled page - and yields a high integrity impact with no confidentiality or availability loss. Per the CVSS vector the attacker themselves is unauthenticated (PR:N); exploitation instead rides the victim's existing authenticated session, which is the defining property of CSRF. No EPSS score is provided in the input, this CVE is not listed in CISA KEV, and no PoC or exploit reference is supplied (only the advisory, fix commit, and release are referenced), so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month', indicating a moderate, scheduled-remediation priority rather than an emergency. Net assessment: a genuine but not top-tier issue - real because the missing Security::check_token() is confirmed in source and the fix is confirmed, but its practical risk is bounded by the need to socially engineer a privileged user into visiting a malicious page while authenticated. Note the signal tension to flag for teams: KEV=NO and no PoC alongside a 'this_month' label support treating this as planned patching, not an active-exploitation fire drill; EPSS is missing and cannot be weighed.

An attacker hosts a web page containing a hidden auto-submitting form or image tag targeting the skill.ajax.php add, delete_gradebook_from_skill, save_profile, or delete_profile actions. A Chamilo administrator or DRH who is logged in and then visits that page has their browser silently issue the request, creating, modifying, or deleting skill records, skill profiles, or skill-gradebook associations without their knowledge. No public exploit is identified at time of analysis, but the technique is well understood because the endpoints simply lacked CSRF token validation.