CVE-2026-33707: Weak Password Recovery Mechanism for Forgotten Password in chamilo/chamilo-lms
Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, the default password reset mechanism generates tokens using sha1($email) with no random component, no expiration, and no rate limiting. An attacker who knows a user's email can compute the reset token and change the victim's password without authentication. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33707?
CVE-2026-33707 is considered a high severity vulnerability due to the weak password recovery mechanism that can be exploited to gain unauthorized access.
How do I fix CVE-2026-33707?
To fix CVE-2026-33707, upgrade Chamilo LMS to version 1.11.38 or 2.0.0-RC.3 or later, which includes an improved password recovery mechanism.
What are the consequences of CVE-2026-33707?
CVE-2026-33707 can allow attackers to reset user passwords without authorization, potentially compromising user accounts.
Which versions of Chamilo LMS are affected by CVE-2026-33707?
CVE-2026-33707 affects Chamilo LMS versions prior to 1.11.38 and 2.0.0-RC.3.
What is the nature of the vulnerability in CVE-2026-33707?
The vulnerability in CVE-2026-33707 stems from a password reset mechanism that uses predictable token generation, lacking expiration and rate limiting.