CVE-2026-45141 in LMS
Summary
by MITRE • 10/30/2026
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, the `add`, `delete_gradebook_from_skill`, `save_profile`, and `delete_profile` actions in `public/main/inc/ajax/skill.ajax.php` perform database mutations without `Security::check_token()` validation. An attacker can use cross-site request forgery to cause an authenticated administrator or DRH who visits a malicious page to create, modify, or delete skill records and profiles, or remove skill-gradebook associations. This issue is fixed in version 2.0.1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
Chamilo LMS represents a widely deployed open-source learning management system utilized by educational institutions globally to manage courses, users, and assessments. The vulnerability identified within versions prior to 2.0.1 resides specifically in the AJAX endpoint located at public/main/inc/ajax/skill.ajax.php. This file handles critical administrative functions including adding new skills, deleting gradebook associations from specific skills, saving user profile modifications, and deleting existing profiles. These operations constitute significant database mutations that alter the core configuration and data integrity of the learning management system. The absence of proper request validation in these endpoints creates a severe security gap that can be exploited by malicious actors to perform unauthorized actions on behalf of authenticated users.
The technical flaw is rooted in the lack of Cross-Site Request Forgery (CSRF) protection mechanisms within the specified PHP functions. Specifically, the code fails to invoke Security::check_token() before processing any state-changing requests. In secure web application architectures, this function typically validates a unique, unpredictable anti-CSRF token that must be included with every form submission or AJAX request initiated by an authenticated user's browser. Without this validation step, the server treats all incoming requests as legitimate provided they originate from a session associated with an administrator or DRH (Director of Human Resources) account. This design oversight allows attackers to craft malicious web pages containing hidden forms or JavaScript that automatically submits these API calls when visited by a logged-in victim.
The operational impact of this vulnerability is substantial, particularly given the privileged nature of the targeted user roles. An attacker who can trick an administrator into visiting a specially crafted URL could force the creation of new skill records, effectively manipulating the curriculum structure without authorization. Furthermore, the ability to delete gradebook associations from skills disrupts academic tracking and assessment data integrity. More critically, the capability to save or delete profiles allows for unauthorized modification of user identities, permissions, and personal information. This can lead to privilege escalation if an attacker modifies a standard user's profile to grant themselves administrative rights, or it can result in denial of service by deleting critical user accounts necessary for institutional operations.
This vulnerability is classified under CWE-352, which defines Cross-Site Request Forgery as the inclusion of untrusted data in state-changing requests without proper validation. From a threat intelligence perspective, this aligns with MITRE ATT&CK technique T1076, known as Remote Command Execution through Browser or Web Application Interfaces, specifically leveraging CSRF to execute administrative commands. The exploitation requires social engineering elements such as phishing emails or malicious websites that prompt the victim user to load the attacker-controlled page while their session for Chamilo LMS remains active in the browser.
Mitigation strategies must focus on implementing robust anti-CSRF protections across all state-changing endpoints immediately upon upgrading to version 2.0.1, which contains the official fix. For systems still running older versions where an upgrade is not immediately feasible, administrators should implement network-level controls such as restricting access to the skill.ajax.php endpoint via IP whitelisting if possible, or deploying a Web Application Firewall that can detect and block requests lacking valid CSRF tokens. Additionally, enforcing strict session management policies, including shorter timeout periods for administrative sessions and requiring re-authentication for sensitive operations like profile deletion, can significantly reduce the window of opportunity for exploitation. Regular security audits should also be conducted to ensure no other endpoints in the application suffer from similar validation deficiencies.