CVE-2026-114390 in Chamilo LMS
Summary
by MITRE • 10/22/2026
Chamilo LMS from 2.0.0-alpha.1 before 2.0.0-RC.3 contains a missing authorization vulnerability in legacy AJAX handlers under public/main/inc/ajax/ that exposes user names and certificates. Unauthenticated or low-privileged users can call actions like get_users_by_group_course, user_by_all_roles, and export_all_certificates to harvest user names and other learners' certificate PDFs.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in Chamilo Learning Management System versions prior to 2.0.0-RC.3 represents a critical failure in access control mechanisms within the application's legacy AJAX handler infrastructure. Located specifically under the public/main/inc/ajax/ directory, these handlers were designed to facilitate dynamic interactions between the client-side interface and the server backend. However, they lack proper authorization checks that verify whether the requesting user has sufficient privileges to execute specific actions or view sensitive data. This architectural flaw allows unauthenticated users or those with low-privileged accounts to bypass intended security boundaries, effectively treating protected endpoints as public resources. The absence of robust session validation or role-based access control at this layer creates a significant attack surface that can be exploited remotely without prior authentication.
The technical nature of this vulnerability is classified under CWE-285, which describes Improper Access Control, and aligns with the ATT&CK technique T1078, Valid Accounts, as it involves leveraging insufficiently secured access paths to gain unauthorized information. The specific functions exposed include get_users_by_group_course, user_by_all_roles, and export_all_certificates. These endpoints are intended for administrative or instructor-level operations where privacy is paramount. By calling these methods directly via HTTP requests, an attacker can retrieve comprehensive lists of usernames associated with specific courses or groups. This capability facilitates reconnaissance activities, allowing adversaries to map out the user base, identify active learners, and potentially correlate identities with other leaked data sources. The exposure of such granular user information undermines the confidentiality guarantees expected in educational platforms handling personal identifiable information.
Beyond simple username enumeration, the vulnerability extends to the unauthorized export of learner certificates. The export_all_certificates function allows an attacker to download PDF documents that contain sensitive academic records and potentially personally identifiable details about students or employees who have completed courses. This data leakage poses severe privacy risks and compliance challenges for institutions using Chamilo LMS, particularly those subject to regulations such as GDPR or FERPA. The ability to harvest these certificates en masse means that an attacker can not only identify individuals but also access their academic achievements and credentials without permission. This transforms a simple information disclosure flaw into a tool for social engineering, identity theft, or targeted phishing campaigns against specific users identified through the harvested data.
The operational impact of this vulnerability is substantial, affecting both the integrity of user privacy and the trustworthiness of the learning platform. Institutions may face reputational damage and legal liabilities due to the exposure of student records. For individual learners, the risk includes potential harassment or targeted attacks based on their academic profile and identity information revealed through usernames and certificates. The ease of exploitation means that automated scripts can be deployed to scrape large volumes of data quickly, amplifying the scale of the breach beyond what a manual attacker could achieve. This scalability makes the vulnerability particularly dangerous in environments with thousands of active users, where even partial exposure can lead to significant harm.
Mitigation strategies must focus on immediate remediation and long-term architectural improvements. The primary solution is to upgrade Chamilo LMS to version 2.0.0-RC.3 or later, where these authorization gaps have been addressed by the developers. For organizations unable to patch immediately due to operational constraints, temporary mitigations should include restricting access to the public/main/inc/ajax/ directory via web server configuration rules that require valid session tokens for all AJAX requests. Implementing a Web Application Firewall with specific rule sets to block unauthorized calls to known vulnerable endpoints can also provide an additional layer of defense. Furthermore, security audits should be conducted to ensure no other legacy handlers share similar authorization flaws, as this incident suggests a broader pattern in the older codebase that may require refactoring to align with modern secure coding standards and role-based access control principles.