Insecure Direct Object Reference in Chamilo LMS Affects User Progress Management
CVE-2026-33702
What is CVE-2026-33702?
Chamilo LMS, a widely-used learning management system, prior to versions 1.11.38 and 2.0.0-RC.3, features an IDOR vulnerability in its Learning Path progress saving mechanism. This flaw allows authenticated users to manipulate another user's Learning Path progress by altering the uid (user ID) parameter in the request to lp_ajax_save_item.php. The vulnerability arises from the lack of proper validation of user permissions, enabling unauthorized modification of scores, completion statuses, and progress timestamps. Users enrolled in a course can exploit this vulnerability to overwrite peers’ progress data. The issue was addressed in recent updates, making it crucial for all users to upgrade to the patched versions to ensure system integrity.
Affected Version(s)
chamilo-lms < 1.11.38 < 1.11.38
chamilo-lms >= 2.0.0-alpha.1, < 2.0.0-RC.3 < 2.0.0-alpha.1, 2.0.0-RC.3