Insecure Direct Object Modification Vulnerability in Chamilo LMS by Chamilo Association

CVE-2026-40291

What is CVE-2026-40291?

Chamilo LMS, an open-source learning management system, contains a vulnerability that allows authenticated users with the ROLE_STUDENT to escalate their privileges to ROLE_ADMIN. This security flaw exists in the PUT /api/users/{id} endpoint in versions prior to 2.0.0-RC.3. The issue arises due to improper validation of user roles, permitting any user to modify their roles field on their user record. This exploitation enables unauthorized access to full administrative controls over the platform, impacting courses, user data, grades, and settings. The vulnerability has been addressed in version 2.0.0-RC.3.

References