# CVE-2026-33706: Chamilo LMS privilege escalation in REST API

Source: https://junglewise.ai/threats/cve-2026-33706-chamilo-lms-privilege-escalation-in-rest-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-10. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2026-33706 · Severity: high · CVSS 7.1 · Published 2026-04-10

Chamilo LMS is a popular open-source learning management system used by educational institutions and corporations to deliver online courses. A security flaw allows students or other low-privileged users with API access to upgrade their own accounts to teacher or administrator status. This allows unauthorized users to create and manage courses, modify grades, and access sensitive educational data, undermining the integrity of the learning platform.

Technologies: [Chamilo Lms](https://junglewise.ai/threats/technologies/chamilo-lms). Vendors: [Chamilo](https://junglewise.ai/threats/vendors/chamilo).

## Quick answers

**Is CVE-2026-33706 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33706 being exploited in the wild.

**How severe is CVE-2026-33706?** High severity, with a CVSS score of 7.1, published 10 April 2026.

**Which products and versions are affected?** Chamilo Chamilo LMS <= 1.11.36.

**Is there a fix for CVE-2026-33706?** A patch was published on 2026-04-16: NVD updated with patch information and version 1.11.38 fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33706 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-33706?** Check whether you run Chamilo Lms. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper privilege management vulnerability (CWE-269) exists in the REST API of Chamilo LMS within the `updateUserFromUserName` method in `main/inc/lib/webservices/Rest.php`. While the code prevents users from modifying other accounts, it fails to validate or restrict the fields a user can update on their own profile. Specifically, an authenticated user with a REST API key can send a request to the `update_user_from_username` endpoint to change their `status` field from 5 (Student) to 1 (Teacher/CourseManager), or modify other sensitive fields like `roles` and `auth_source`. This allows for full self-privilege escalation. The issue is addressed in version 1.11.38 by restricting non-admin users from modifying administrative fields.

## Affected products

- Chamilo Chamilo LMS <= 1.11.36

## Timeline

- 2026-04-10: advisory: GHSA-3gqc-xr75-pcpw published
- 2026-04-10: disclosed: CVE-2026-33706 published
- 2026-04-16: patched: NVD updated with patch information and version 1.11.38 fix

## References

- [https://github.com/chamilo/chamilo-lms/commit/0acf8a196307c66c049f97f5ff76cf21c4a08127](https://github.com/chamilo/chamilo-lms/commit/0acf8a196307c66c049f97f5ff76cf21c4a08127)
- [https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-3gqc-xr75-pcpw](https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-3gqc-xr75-pcpw)

## Related threats

- [Chamilo LMS SQL injection via groupOp parameter](https://junglewise.ai/threats/cve-2026-45146-chamilo-lms-is-an-open-source-learning-management-system-prior-to)
- [Chamilo LMS unsafe deserialization in career data](https://junglewise.ai/threats/cve-2026-45145-chamilo-lms-is-an-open-source-learning-management-system-prior-to)
- [Chamilo LMS stored XSS in user profile fields](https://junglewise.ai/threats/cve-2026-45144-chamilo-lms-is-an-open-source-learning-management-system-from-2-0)
- [Chamilo LMS CSRF in skill management AJAX](https://junglewise.ai/threats/cve-2026-45141-chamilo-lms-is-an-open-source-learning-management-system-prior-to)
- [Chamilo LMS arbitrary code execution in HTML_QuickForm](https://junglewise.ai/threats/cve-2026-44344-chamilo-lms-is-an-open-source-learning-management-system-in-the-1)