Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-34602 Details

Description

Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the /api/course_rel_users endpoint is vulnerable to Insecure Direct Object Reference (IDOR), allowing an authenticated attacker to modify the user parameter in the request body to enroll any arbitrary user into any course without proper authorization checks. The backend trusts the user-supplied input for the user field and performs no server-side verification that the requester owns the referenced user ID or has permission to act on behalf of other users. This enables unauthorized manipulation of user-course relationships, potentially granting unintended access to course materials, bypassing enrollment controls, and compromising platform integrity. This issue has been fixed in version 2.0.0-RC.3.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: [email protected]CVSS-B:7.1 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/chamilo/chamilo-lms/commit/2a9f060fa9d50fc9a92ed93af774d2619642df92	[email protected]	Patch
https://github.com/chamilo/chamilo-lms/commit/bd2ba34c2e74475587e38c74c90c2934e69c8779	[email protected]	Patch
https://github.com/chamilo/chamilo-lms/commit/c9c30cdc48afae57cd6ab012ae2eceafd351a40e	[email protected]	Patch
https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3	[email protected]	ProductRelease Notes
https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-x373-8j9j-g5pj	[email protected]	Vendor Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-639	Authorization Bypass Through User-Controlled Key	[email protected]

Affected Products

Product	Versions
chamilo chamilo lms	<= 1.11.38 2.0.0 alpha1 2.0.0 alpha2 2.0.0 alpha3 2.0.0 alpha4
CPE cpe:2.3:a:chamilo:chamilo_lms:::::::: cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha1:::::: cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha2:::::: cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha3:::::: cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha4:::::: cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha5:::::: cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta1:::::: cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta2:::::: cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta3:::::: cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc1:::::: cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc2:::::: Remediation No remediation found in references.

Product

Versions

chamilo chamilo lms

<= 1.11.38

2.0.0 alpha1

2.0.0 alpha2

2.0.0 alpha3

2.0.0 alpha4

CPE

cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*
cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha1:*:*:*:*:*:*
cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha2:*:*:*:*:*:*
cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha3:*:*:*:*:*:*
cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha4:*:*:*:*:*:*
cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha5:*:*:*:*:*:*
cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta1:*:*:*:*:*:*
cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta2:*:*:*:*:*:*
cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta3:*:*:*:*:*:*
cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc1:*:*:*:*:*:*
cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc2:*:*:*:*:*:*

Remediation

No remediation found in references.

Change History

5 change records found show changes

Date	Action	Recorded By
Jul 24, 2026	CVE Translated	[email protected]
Jun 17, 2026	CVE Modified	[email protected]
Jun 17, 2026	CVE Modified	CISA-ADP
Apr 22, 2026	Initial Analysis	[email protected]
Apr 14, 2026	New CVE Received	[email protected]