CVE-2026-33706: Chamilo LMS privilege escalation in REST API

CVE-2026-33706 · Severity: high · CVSS 7.1 · Published 2026-04-10

Chamilo LMS is a popular open-source learning management system used by educational institutions and corporations to deliver online courses. A security flaw allows students or other low-privileged users with API access to upgrade their own accounts to teacher or administrator status. This allows unauthorized users to create and manage courses, modify grades, and access sensitive educational data, undermining the integrity of the learning platform.

Technologies: Chamilo Lms. Vendors: Chamilo.

Quick answers

Is CVE-2026-33706 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-33706 being exploited in the wild.
How severe is CVE-2026-33706?
High severity, with a CVSS score of 7.1, published 10 April 2026.
Which products and versions are affected?
Chamilo Chamilo LMS <= 1.11.36.
Is there a fix for CVE-2026-33706?
A patch was published on 2026-04-16: NVD updated with patch information and version 1.11.38 fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33706 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-33706?
Check whether you run Chamilo Lms. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper privilege management vulnerability (CWE-269) exists in the REST API of Chamilo LMS within the `updateUserFromUserName` method in `main/inc/lib/webservices/Rest.php`. While the code prevents users from modifying other accounts, it fails to validate or restrict the fields a user can update on their own profile. Specifically, an authenticated user with a REST API key can send a request to the `update_user_from_username` endpoint to change their `status` field from 5 (Student) to 1 (Teacher/CourseManager), or modify other sensitive fields like `roles` and `auth_source`. This allows for full self-privilege escalation. The issue is addressed in version 1.11.38 by restricting non-admin users from modifying administrative fields.

Affected products

  • Chamilo Chamilo LMS <= 1.11.36

Timeline

  • 2026-04-10: advisory: GHSA-3gqc-xr75-pcpw published
  • 2026-04-10: disclosed: CVE-2026-33706 published
  • 2026-04-16: patched: NVD updated with patch information and version 1.11.38 fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.