Cross-Site Request Forgery in Chamilo LMS Open-Source Learning Management System

CVE-2026-45141

What is CVE-2026-45141?

Chamilo LMS, an open-source learning management system, contains a susceptibility to cross-site request forgery (CSRF) attacks. Specifically, actions such as add, delete_gradebook_from_skill, save_profile, and delete_profile in the public/main/inc/ajax/skill.ajax.php script lack the necessary Security::check_token() validation for database modifications. This oversight allows attackers to exploit the vulnerability if an authenticated administrator or designated staff member unknowingly visits a malicious page, enabling the attacker to create, modify, or delete skill records and user profiles, or alter skill-gradebook links. The vulnerability has been addressed in version 2.0.1.

References