Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.1
Chamilo LMS: Unauthorized Access to Courses and User Enrollment
CVE-2026-34602
Summary
An attacker can enroll any user into any course without permission. This can give users access to course materials and bypass enrollment controls. Update to version 2.0.0-RC.3 to fix this issue.
Original title
Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the /api/course_rel_users endpoint is vulnerable to Insecure Direct Object Reference (IDOR), allowing an a...
Original description
Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the /api/course_rel_users endpoint is vulnerable to Insecure Direct Object Reference (IDOR), allowing an authenticated attacker to modify the user parameter in the request body to enroll any arbitrary user into any course without proper authorization checks. The backend trusts the user-supplied input for the user field and performs no server-side verification that the requester owns the referenced user ID or has permission to act on behalf of other users. This enables unauthorized manipulation of user-course relationships, potentially granting unintended access to course materials, bypassing enrollment controls, and compromising platform integrity. This issue has been fixed in version 2.0.0-RC.3.
nvd CVSS3.1
7.1
Vulnerability type
CWE-639
Authorization Bypass Through User-Controlled Key
- https://github.com/chamilo/chamilo-lms/commit/2a9f060fa9d50fc9a92ed93af774d26196...
- https://github.com/chamilo/chamilo-lms/commit/bd2ba34c2e74475587e38c74c90c2934e6...
- https://github.com/chamilo/chamilo-lms/commit/c9c30cdc48afae57cd6ab012ae2eceafd3...
- https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3
- https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-x373-8j9j-g5pj
Published: 14 Apr 2026 · Updated: 14 Apr 2026 · First seen: 14 Apr 2026