Executive brief
Chamilo LMS is a learning management system used by educational institutions and businesses to deliver online courses. A security flaw allows any student or user enrolled in a course to modify the grades, completion status, and progress records of other students. This could lead to unauthorized grade changes and compromise the integrity of academic or training records.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the Learning Path progress saving endpoint (lp_ajax_save_item.php). The application accepts a 'uid' (user ID) parameter directly from the request and uses it to load and modify Learning Path data—including scores, status, and completion time—without verifying that the authenticated user has permission to modify that specific ID. An attacker with low-privileged access (any enrolled user) can manipulate this parameter to overwrite the progress data of any other user in the system. The issue is resolved in versions 1.11.38 and 2.0.0-RC.3 by ensuring the system uses the authenticated session's user ID instead of the request parameter.
Affected products
- Chamilo Chamilo LMS < 1.11.38, < 2.0.0-RC.3
Timeline
- 2026-03-11: other: Vulnerability reported
- 2026-04-10: disclosed: Security advisory published
- 2026-04-10: patched: Fixes released in versions 1.11.38 and 2.0.0-RC.3