CVE-2026-39878: Chamilo stored XSS via user registration leads to admin account takeover
Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form that allows any unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser session, leading to full platform admin account takeover. This has been patched in 1.11.40.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Chamilo LMSto a version that resolves this vulnerability.Fixed in 1.11.40
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39878?
The severity of CVE-2026-39878 is critical with a score of 9.3.
What vulnerability does CVE-2026-39878 exploit?
CVE-2026-39878 exploits a stored cross-site scripting (XSS) vulnerability in the user registration form of Chamilo LMS.
How does CVE-2026-39878 lead to an admin account takeover?
CVE-2026-39878 allows an unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser session, enabling full platform admin account takeover.
Which versions of Chamilo LMS are affected by CVE-2026-39878?
Chamilo LMS versions 1.11.38 and earlier are affected by CVE-2026-39878.
How can I mitigate the risk of CVE-2026-39878?
To mitigate the risk of CVE-2026-39878, users should upgrade to the latest version of Chamilo LMS where the vulnerability is patched.