Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the REST API stats endpoint allows any authenticated user (including low-privilege students with ROLE_USER) to read any other user's learning progress, certificates, and gradebook scores for any course, without enrollment or supervisory relationship. This vulnerability is fixed in 2.0.0-RC.3.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 10 Apr 2026 18:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the REST API stats endpoint allows any authenticated user (including low-privilege students with ROLE_USER) to read any other user's learning progress, certificates, and gradebook scores for any course, without enrollment or supervisory relationship. This vulnerability is fixed in 2.0.0-RC.3. | |
| Title | Chamilo LMS has an IDOR in REST API Stats Endpoint Exposes Any User's Learning Data | |
| Weaknesses | CWE-639 CWE-862 |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-04-10T18:01:26.027Z
Reserved: 2026-03-17T20:35:49.929Z
Link: CVE-2026-33141
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-04-10T18:16:42.743
Modified: 2026-04-10T18:16:42.743
Link: CVE-2026-33141
Redhat
No data.
OpenCVE Enrichment
No data.