Executive brief
Chamilo LMS is a learning management system used for online education and training. A security flaw in how the system generates API keys makes them highly predictable and easy to guess. An attacker who knows a user's ID and the approximate time their account was created can take over that user's API access, potentially leading to the exposure of sensitive student data or unauthorized administrative actions.
Technical details
The vulnerability exists in the `add_api_key` function within `usermanager.lib.php`. API keys were generated using the formula `md5(time() + (user_id * 5) - rand(10000, 10000))`. Because the `rand()` function was called with identical minimum and maximum values, it consistently returned 10000, rendering the output entirely deterministic based on the Unix timestamp and the sequential user ID. An attacker can brute-force the resulting MD5 hash by testing a small window of timestamps (e.g., 86,400 possibilities for a 24-hour window). This allows for unauthorized API access, which can be further leveraged for privilege escalation or data exfiltration. The issue is resolved by replacing the weak generation logic with cryptographically secure random bytes.
Affected products
- Chamilo Chamilo LMS < 1.11.38, < 2.0.0-RC.3
Timeline
- 2026-04-10: advisory: Vendor advisory published via GitHub
- 2026-04-10: disclosed: CVE-2026-33710 published
- 2026-04-16: patched: NVD analysis and CPE information updated