CVE-2026-40291
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
In Chamilo LMS prior to version 2.0.0-RC.3, an insecure direct object modification vulnerability in the PUT /api/users/{id} endpoint allows any authenticated user with ROLE_STUDENT to escalate their privileges to ROLE_ADMIN by modifying the roles field on their own user record.
Risk Assessment
Successful exploitation grants full administrative control of the platform, including access to all courses, user data, grades, and administrative settings.
Recommendation
Update Chamilo LMS to version 2.0.0-RC.3 or later, which contains the fix.
Other vulnerabilities in Chamilo LMS
See all- CVE-2026-39878Critical
Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form. An unauthenticated attacker can execute arbitrary JavaScript in an administrator's browser session, leading to full platform admin account takeover.
- CVE-2026-35196High
In Chamilo LMS prior to 2.0.0-RC.3, an OS command injection exists in main/inc/ajax/gradebook.ajax.php in the export_all_certificates action. The course code from the session is concatenated into shell_exec() without sanitization, allowing arbitrary command execution via session manipulation.
- CVE-2026-34602High
An Insecure Direct Object Reference (IDOR) vulnerability in the /api/course_rel_users endpoint of Chamilo LMS prior to version 2.0.0-RC.3. An authenticated attacker can modify the user parameter in the request to enroll any arbitrary user into any course without proper authorization. The backend trusts user-supplied input and does not verify if the requester has permission to act on behalf of other users.
- CVE-2026-34370Medium
Chamilo LMS versions prior to 2.0.0-RC.3 have an IDOR vulnerability in the notebook module. An authenticated student can read private notes of any other user by manipulating the notebook_id parameter in the editnote action. The application fetches note content without ownership verification.
- CVE-2026-34161Medium
Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the social post attachment upload functionality. An authenticated user can upload a malicious HTML file containing JavaScript via the /api/social_post_attachments endpoint. The file is served without sanitization, content type restrictions, or Content-Disposition header, causing JavaScript execution in the application context. This can lead to session hijacking, account takeover, privilege escalation, and other actions. This issue has been fixed in version 2.0.0-RC.3.
- CVE-2026-34160High
Chamilo LMS before version 2.0.0-RC.3 has a Server-Side Request Forgery (SSRF) vulnerability in the PENS plugin endpoint. The endpoint is accessible without authentication and accepts a package-url parameter that the server fetches without filtering private IP addresses.
- CVE-2026-33715High
Chamilo LMS version 2.0-RC.2 has an unauthenticated endpoint install.ajax.php that accepts arbitrary Symfony Mailer DSN, enabling SSRF into internal networks via SMTP. An unauthenticated attacker can also use the server as an open email relay.
- CVE-2023-39582Medium
SQL Injection vulnerability in Chamilo LMS versions 1.11 through 1.11.20 allows a remote privileged attacker to obtain sensitive information via the import sessions functions.
- CVE-2023-31807Medium
A Cross-Site Scripting vulnerability was found in Chamilo LMS version 1.11.18. It allows a local attacker to execute arbitrary code via a crafted payload in the personal notes function.
- CVE-2023-31806Medium
A Cross-Site Scripting (XSS) vulnerability was found in Chamilo LMS version 1.11.18 in the 'My Progress' function. A local attacker can execute arbitrary JavaScript code via a crafted payload.
Original NVD description (English source)
Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an insecure direct object modification vulnerability in the PUT /api/users/{id} endpoint allows any authenticated user with ROLE_STUDENT to escalate their privileges to ROLE_ADMIN by modifying the roles field on their own user record. The API Platform security expression is_granted('EDIT', object) only verifies record ownership, and the roles field is included in the writable serialization group, enabling any user to set arbitrary roles such as ROLE_ADMIN. Successful exploitation grants full administrative control of the platform, including access to all courses, user data, grades, and administrative settings. This issue has been fixed in version 2.0.0-RC.3.