Executive brief
Chamilo LMS, a popular open-source learning management system, contains a security flaw that allows any logged-in user to view the private educational records of other students. This includes sensitive information such as course progress, certificates, and gradebook scores. An attacker could use this to access private academic data they are not authorized to see, potentially leading to privacy violations and data exposure.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the Chamilo LMS REST API stats endpoint. The root cause is a missing authorization check in the 'GetStatsAction' controller and the 'User' entity security expressions, which only verify that a user is authenticated ('ROLE_USER') rather than checking if they have permission to access the specific user ID requested. By sending a crafted GET request to '/api/users/{id}/courses/{courseId}/stats/{metric}', an authenticated attacker can retrieve learning progress, certificates, and gradebook scores for any user and course. This bypasses enrollment and supervisory restrictions. The issue is resolved in version 2.0.0-RC.3 by implementing proper access control logic.
Affected products
- Chamilo Chamilo LMS < 2.0.0-RC.3
Timeline
- 2026-04-10: disclosed
- 2026-04-10: advisory
- 2026-04-10: patched