CVE-2025-52469: Chamilo: Friend Request Workflow Bypass - Unauthorized Friend Addition and ID Validation Bypass
Chamilo is a learning management system. Prior to version 1.11.30, a logic vulnerability in the friend request workflow of Chamilo’s social network module allows an authenticated user to forcibly add any user as a friend by directly calling the AJAX endpoint. The attacker can bypass the normal flow of sending and accepting friend requests, and even add non-existent users. This breaks access control and social interaction logic, with potential privacy implications. This issue has been patched in version 1.11.30.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-52469?
CVE-2025-52469 is classified as a high severity vulnerability due to its potential for unauthorized friend addition within Chamilo.
How do I fix CVE-2025-52469?
To fix CVE-2025-52469, upgrade your Chamilo installation to version 1.11.30 or later.
What does CVE-2025-52469 affect?
CVE-2025-52469 affects versions of Chamilo prior to 1.11.30, specifically impacting its friend request workflow.
Who can exploit CVE-2025-52469?
CVE-2025-52469 can be exploited by any authenticated user within the Chamilo system.
What is the impact of CVE-2025-52469?
The impact of CVE-2025-52469 allows unauthorized users to add friends without proper validation in Chamilo's social network module.