CVE-2026-114390: Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization in AJAX Handlers
Chamilo LMS from 2.0.0-alpha.1 before 2.0.0-RC.3 contains a missing authorization vulnerability in legacy AJAX handlers under public/main/inc/ajax/ that exposes user names and certificates. Unauthenticated or low-privileged users can call actions like getusersbygroupcourse, userbyallroles, and exportallcertificates to harvest user names and other learners' certificate PDFs.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Chamilo LMS versions from 2.0.0-alpha.1 up to, but not including, 2.0.0-RC.3 are affected. The issue is in legacy AJAX handlers under public/main/inc/ajax/.
What access does an attacker need?
The affected actions can be invoked by unauthenticated users or users with low privileges. No user interaction is required.
What information could be exposed?
An attacker may harvest user names and other learners' certificate PDFs through actions including get_users_by_group_course, user_by_all_roles, and export_all_certificates.
What is the available remediation?
Upgrade to Chamilo LMS 2.0.0-RC.3 or later, which is outside the affected version range.