CVE-2026-33706: Chamilo LMS has a REST API Self-Privilege Escalation (Student → Teacher)

Q: What is the severity of CVE-2026-33706?

CVE-2026-33706 is considered a critical vulnerability due to its potential for privilege escalation within the Chamilo LMS.

Q: How do I fix CVE-2026-33706?

To fix CVE-2026-33706, upgrade Chamilo LMS to version 1.11.38 or later.

Q: Who is affected by CVE-2026-33706?

Any authenticated user of Chamilo LMS versions prior to 1.11.38 is affected by CVE-2026-33706.

Q: What type of vulnerability is CVE-2026-33706?

CVE-2026-33706 is a REST API self-privilege escalation vulnerability in Chamilo LMS.

Q: Can students exploit CVE-2026-33706?

Yes, students can exploit CVE-2026-33706 to elevate their status to that of a teacher using the REST API.

Published Apr 10, 2026

Updated

Chamilo LMS is a learning management system. Prior to 1.11.38, any authenticated user with a REST API key can modify their own status field via the updateuserfromusername endpoint. A student (status=5) can change their status to Teacher/CourseManager (status=1), gaining course creation and management privileges. This vulnerability is fixed in 1.11.38.

Affected Software

2 affected components

Chamilo Chamilo LMS<1.11.38

Remediation

Patch Available

https://github.com/chamilo/chamilo-lms/commit/0acf8a196307c66c049f97f5ff76cf21c4a08127

Event History

Apr 10, 2026

CVE Published

via MITRE·06:51 PM

Data Sourced

via MITRE·06:51 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-33706?

CVE-2026-33706 is considered a critical vulnerability due to its potential for privilege escalation within the Chamilo LMS.

How do I fix CVE-2026-33706?