User Enumeration Vulnerability in Chamilo LMS Affects All Authenticated Users
CVE-2026-33736

6.5MEDIUM

Key Information:

Vendor

Chamilo

Status
Chamilo-lms
Vendor
CVE Published:
10 April 2026

What is CVE-2026-33736?

Chamilo LMS, a widely-used learning management system, is susceptible to a user enumeration vulnerability that allows any authenticated user, including those with student roles, to access personal information of other users. This includes sensitive details like email addresses, phone numbers, and user roles through the API endpoint /api/users. The issue, which can lead to privacy violations and unauthorized insights into user data, has been addressed in the release 2.0.0-RC.3.

Affected Version(s)

chamilo-lms >= 2.0.0-alpha.1, < 2.0.0-RC.3

References

https://github.com/chamilo/chamilo-lms/security/advisorie...
x_refsource_CONFIRM
https://github.com/chamilo/chamilo-lms/commit/1739371ce1c...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.