CVE-2026-34370 Details
Description
Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the notebook module contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated student to read the private course notes of any other user on the platform by manipulating the notebook_id parameter in the editnote action. The application fetches the note content using only the supplied integer ID without verifying that the requesting user owns the note, and the full title and HTML body are rendered in the edit form and returned to the attacker's browser. While ownership checks exist in the write paths (updateNote() and delete_note()), they are entirely absent from the read path (get_note_information()). This issue has been fixed in version 2.0.0-RC.3.
A vulnerability allowing Insecure Direct Object Reference (IDOR) has been identified in the notebook module of Chamilo LMS, affecting versions prior to 2.0.0-RC.3. This vulnerability allows authenticated students to access the private course notes of other users by manipulating the notebook_id parameter in the editnote action. The application retrieves note content using only the provided ID, without verifying ownership, and displays the full title and HTML body in the edit form, which is then sent to the user's browser. While ownership checks are implemented for updating and deleting notes, they are completely missing for reading notes, creating a read-only IDOR that exposes private notes across the learning management system.
Users can update to Chamilo LMS version 2.0.0-RC.3, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3 | [email protected] | ProductRelease Notes |
| https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-fm35-2hvw-564q | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-285 | Improper Authorization | [email protected] |
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| chamilo chamilo lms | <= 1.11.38 2.0.0 alpha1 2.0.0 alpha2 2.0.0 alpha3 2.0.0 alpha4 2.0.0 alpha5 2.0.0 beta1 2.0.0 beta2 2.0.0 beta3 2.0.0 rc1 2.0.0 rc2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | Initial Analysis | [email protected] |
| Apr 14, 2026 | New CVE Received | [email protected] |