What is the CVSS score of EUVD-2026-22772?

EUVD-2026-22772 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Chamilo Lms are affected by EUVD-2026-22772?

Chamilo LMS versions prior to 2.0.0-RC.3 contain a privilege escalation vulnerability allowing any authenticated student to grant themselves administrator access through API manipulation, potentially…. A patch is available.

How to fix or mitigate EUVD-2026-22772?

Within 24 hours: Identify all Chamilo LMS instances in production and determine current versions via admin console or API documentation endpoints. Within 7 days: Apply vendor patch to upgrade all instances to version 2.0.0-RC.3 or later; if patching is blocked by dependencies, immediately implement network segmentation restricting API access to trusted internal networks only. Within 30 days: Conduct access audit of administrative accounts created in past 12 months and review API access logs for suspicious PUT requests to /api/users endpoints; rotate administrator credentials for all Chamilo instances.

Chamilo Lms EUVD-2026-22772

| CVE-2026-40291 HIGH

Improper Privilege Management (CWE-269)

2026-04-14 security-advisories@github.com

Privilege Escalation Chamilo Lms

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 22, 2026 - 18:37 nvd

Patch available

Re-analysis Queued

Apr 17, 2026 - 15:52 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:56 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2.0-RC.3

Analysis Generated

Apr 14, 2026 - 22:42 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 22:22 euvd

EUVD-2026-22772

Analysis Generated

Apr 14, 2026 - 22:22 vuln.today

CVE Published

Apr 14, 2026 - 22:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an insecure direct object modification vulnerability in the PUT /api/users/{id} endpoint allows any authenticated user with ROLE_STUDENT to escalate their privileges to ROLE_ADMIN by modifying the roles field on their own user record. The API Platform security expression is_granted('EDIT', object) only verifies record ownership, and the roles field is included in the writable serialization group, enabling any user to set arbitrary roles such as ROLE_ADMIN. Successful exploitation grants full administrative control of the platform, including access to all courses, user data, grades, and administrative settings. This issue has been fixed in version 2.0.0-RC.3.

AnalysisAI

Privilege escalation in Chamilo LMS versions prior to 2.0.0-RC.3 allows authenticated students to gain full administrative access via API manipulation. Low-privilege users (ROLE_STUDENT) can modify their own user record through the PUT /api/users/{id} endpoint to assign themselves ROLE_ADMIN privileges, bypassing intended access controls. The vulnerability stems from inadequate authorization checks that verify only record ownership without restricting modification of security-critical fields. With CVSS 8.8 (High) and low attack complexity requiring only basic authentication, this represents a critical access control failure in educational platforms. No public exploit code or active exploitation (CISA KEV) identified at time of analysis, though the straightforward attack vector makes exploitation trivial for malicious insiders.

Technical ContextAI

Chamilo LMS is an open-source learning management system built on API Platform, which uses Symfony security expressions for authorization. The vulnerability resides in the API Platform security configuration for the User entity's PUT endpoint. The security expression is_granted('EDIT', object) performs ownership validation but fails to implement attribute-level access control. The roles field is improperly included in the writable serialization group, allowing authenticated users to modify their own role assignments through standard HTTP PUT requests. This represents a classic example of CWE-269 (Improper Privilege Management), where the application fails to properly validate authorization for privilege-modifying operations. The API Platform framework's declarative security model relies on developers explicitly restricting access to sensitive fields, which was not implemented for the roles attribute. The vulnerability specifically affects the /api/users/{id} REST endpoint where {id} can be the authenticated user's own identifier.

RemediationAI

Immediately upgrade to Chamilo LMS version 2.0.0-RC.3 or later, which contains fixes that properly restrict modification of the roles field through API endpoints. The patched release is available at https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3. Organizations unable to immediately upgrade should implement compensating controls including restricting network access to the /api/users/ endpoint to trusted administrative networks only, implementing web application firewall rules to block PUT requests to /api/users/{id} containing roles field modifications, and conducting immediate audits of user role assignments to identify any unauthorized privilege escalations that may have already occurred. Review application logs for suspicious PUT requests to the users API endpoint, particularly those originating from student accounts. After upgrading, verify that the roles field is no longer writable through the API by non-administrative users and consider implementing additional monitoring for privilege changes. Consult the GitHub security advisory at https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-7phx-w897-4c9x for additional vendor guidance.