CVE-2026-33141: Chamilo LMS has an IDOR in REST API Stats Endpoint Exposes Any User's Learning Data
Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the REST API stats endpoint allows any authenticated user (including low-privilege students with ROLEUSER) to read any other user's learning progress, certificates, and gradebook scores for any course, without enrollment or supervisory relationship. This vulnerability is fixed in 2.0.0-RC.3.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33141?
CVE-2026-33141 is rated as a medium severity vulnerability due to the potential exposure of sensitive learning data.
How do I fix CVE-2026-33141?
To mitigate CVE-2026-33141, update Chamilo LMS to version 2.0.0-RC.3 or later, where the vulnerability has been addressed.
Who is affected by CVE-2026-33141?
Any user with authentication privileges in Chamilo LMS prior to version 2.0.0-RC.3 is affected by CVE-2026-33141.
What type of vulnerability is CVE-2026-33141?
CVE-2026-33141 is classified as an Insecure Direct Object Reference (IDOR) vulnerability.
What data can be accessed due to CVE-2026-33141?
CVE-2026-33141 allows an authenticated user to access any other user's learning data exposed through the REST API stats endpoint.