Missing Authorization in Chamilo LMS Affects User Data Privacy
CVE-2026-114390

6.9MEDIUM

Key Information:

Vendor

Chamilo

Status
Chamilo-lms
Vendor
CVE Published:
21 October 2026

What is CVE-2026-114390?

Chamilo LMS versions prior to 2.0.0-RC.3 include a vulnerability in the legacy AJAX handlers located in public/main/inc/ajax/. This flaw permits unauthenticated or low-privileged users to access and execute sensitive actions such as retrieving user names and exporting certificate PDFs. Specifically, actions like get_users_by_group_course and user_by_all_roles can be exploited to compromise data privacy by exposing personal information and credentials of other learners.

Affected Version(s)

chamilo-lms 2.0.0-alpha.1 < 2.0.0-RC.3

References

https://github.com/chamilo/chamilo-lms/issues/7671
issue-tracking
https://github.com/chamilo/chamilo-lms/commit/2861afd4896...
patch
https://github.com/chamilo/chamilo-lms/releases/tag/v2.0....
release-notes

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lighthousekeeper1212
leediay153 from Viettel Post
.