CVE-2026-33708: Chamilo LMS has REST API PII Exposure via get_user_info_from_username
Chamilo LMS is a learning management system. Prior to 1.11.38, the getuserinfofromusername REST API endpoint returns personal information (email, first name, last name, user ID, active status) of any user to any authenticated user, including students. There is no authorization check. This vulnerability is fixed in 1.11.38.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33708?
CVE-2026-33708 has a medium severity due to the exposure of personal user information through an insecure API.
How do I fix CVE-2026-33708?
To fix CVE-2026-33708, update Chamilo LMS to version 1.11.38 or later where the vulnerability has been addressed.
Who is affected by CVE-2026-33708?
Users of Chamilo LMS versions prior to 1.11.38 are affected by CVE-2026-33708.
What types of information are exposed in CVE-2026-33708?
CVE-2026-33708 exposes personal information including email, first name, last name, user ID, and active status.
Is user authentication sufficient to secure CVE-2026-33708?
No, user authentication does not protect against CVE-2026-33708 as the API leaks information to any authenticated user.