What is the CVSS score of EUVD-2026-21561?

EUVD-2026-21561 has a CVSS 3.1 base score of 9.4 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.1%.

Which versions of Chamilo Lms are affected by EUVD-2026-21561?

Chamilo LMS versions 1.11.x (before 1.11.38) and 2.0.0-RC (before RC.3) contain a critical unauthenticated account takeover vulnerability affecting password reset functionality.. A patch is available.

How to fix or mitigate EUVD-2026-21561?

Within 24 hours: Identify all Chamilo LMS instances and document current versions. Within 7 days: Apply vendor patches-upgrade to Chamilo 1.11.38 or later for 1.11.x deployments, and upgrade to 2.0.0-RC.3 or later for 2.0.0-RC deployments. Verify patch installation across all instances. Within 30 days: Audit access logs for suspicious password reset activities, reset credentials for all privileged accounts (administrators, instructors), and require forced password changes for end users; implement monitoring for abnormal account access patterns.

Chamilo Lms EUVD-2026-21561

| CVE-2026-33707 CRITICAL

Weak Password Recovery Mechanism for Forgotten Password (CWE-640)

2026-04-10 security-advisories@github.com

Information Disclosure Chamilo Lms

9.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.4 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 18:37 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:44 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2.0.0-RC.3,1.11.38

EUVD ID Assigned

Apr 10, 2026 - 19:22 euvd

EUVD-2026-21561

Analysis Generated

Apr 10, 2026 - 19:22 vuln.today

CVE Published

Apr 10, 2026 - 19:16 nvd

CRITICAL 9.4

DescriptionGitHub Advisory

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, the default password reset mechanism generates tokens using sha1($email) with no random component, no expiration, and no rate limiting. An attacker who knows a user's email can compute the reset token and change the victim's password without authentication. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

AnalysisAI

Unauthenticated password reset takeover in Chamilo LMS 1.11.x (prior to 1.11.38) and 2.0.0-RC versions (prior to RC.3) allows remote attackers to hijack arbitrary user accounts by computing deterministic reset tokens. The vulnerability stems from insecure token generation using sha1($email) without randomization, expiration, or rate limiting. Attackers knowing a target's email address can directly calculate valid password reset tokens and change account credentials without prior authentication, enabling full account takeover with high confidentiality and integrity impact. No public exploit identified at time of analysis.

Technical ContextAI

Root cause is CWE-640 (weak password recovery using predictable token). Reset mechanism generates tokens via sha1(email_address) - a deterministic hash vulnerable to precomputation attacks. Missing entropy, time-based expiration, and brute-force protection enable offline token calculation from known email addresses. CVSS vector PR:N confirms unauthenticated attack surface.

RemediationAI

Vendor-released patches: upgrade to Chamilo LMS 1.11.38 for 1.11.x branch or 2.0.0-RC.3 for 2.0 branch. Upstream fixes implemented via commits 078d7e5b77679fa7ccfcd6783bd5cc683db0bda8 and 750a45312a0d5c3ad60dbfbd0d959ca40be4a18c introduce cryptographically random token generation, time-limited validity, and rate limiting protections. Official vendor security advisory available at https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-f27g-66gq-g7v2. No workarounds mitigate this vulnerability - upgrade is mandatory. Organizations unable to immediately patch should disable password reset functionality via application configuration until remediation is completed. Monitor authentication logs for anomalous password reset activity targeting high-privilege accounts.