CVE-2026-33736: Chamilo LMS has an Insecure Direct Object Reference (IDOR) - User Data Exposure
Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, any authenticated user (including ROLESTUDENT) can enumerate all platform users and access personal information (email, phone, roles) via GET /api/users, including administrator accounts. This vulnerability is fixed in 2.0.0-RC.3.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33736?
CVE-2026-33736 is classified as a high severity vulnerability due to its potential for unauthorized data exposure involving personal user information.
Who is affected by CVE-2026-33736?
Any authenticated user, including those with ROLE_STUDENT, can be affected by CVE-2026-33736, allowing them to access sensitive user data.
How do I fix CVE-2026-33736?
To mitigate CVE-2026-33736, upgrade Chamilo LMS to version 2.0.0-RC.3 or later to ensure proper access controls are in place.
What type of vulnerability is CVE-2026-33736?
CVE-2026-33736 is an Insecure Direct Object Reference (IDOR) vulnerability that exposes user data.
What data can be exposed due to CVE-2026-33736?
CVE-2026-33736 can expose sensitive user information including emails, phone numbers, and user roles.