Is CVE-2026-33710 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33710 being exploited in the wild.

How severe is CVE-2026-33710?

High severity, with a CVSS score of 7.5, published 10 April 2026.

Which products and versions are affected?

Chamilo Chamilo LMS < 1.11.38, < 2.0.0-RC.3.

Is there a fix for CVE-2026-33710?

A patch was published on 2026-04-16: NVD analysis and CPE information updated Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33710 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-33710?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33710: Chamilo LMS predictable REST API key generation

Q: Which products and versions are affected?

Chamilo Chamilo LMS < 1.11.38, < 2.0.0-RC.3.

Q: Is there a fix for CVE-2026-33710?

A patch was published on 2026-04-16: NVD analysis and CPE information updated Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-33710 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-33710?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33710 · Severity: high · CVSS 7.5 · Published 2026-04-10

Chamilo LMS is a learning management system used for online education and training. A security flaw in how the system generates API keys makes them highly predictable and easy to guess. An attacker who knows a user's ID and the approximate time their account was created can take over that user's API access, potentially leading to the exposure of sensitive student data or unauthorized administrative actions.

Quick answers

Is CVE-2026-33710 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33710 being exploited in the wild.
How severe is CVE-2026-33710?: High severity, with a CVSS score of 7.5, published 10 April 2026.
Which products and versions are affected?: Chamilo Chamilo LMS < 1.11.38, < 2.0.0-RC.3.
Is there a fix for CVE-2026-33710?: A patch was published on 2026-04-16: NVD analysis and CPE information updated Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33710 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-33710?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the `add_api_key` function within `usermanager.lib.php`. API keys were generated using the formula `md5(time() + (user_id * 5) - rand(10000, 10000))`. Because the `rand()` function was called with identical minimum and maximum values, it consistently returned 10000, rendering the output entirely deterministic based on the Unix timestamp and the sequential user ID. An attacker can brute-force the resulting MD5 hash by testing a small window of timestamps (e.g., 86,400 possibilities for a 24-hour window). This allows for unauthorized API access, which can be further leveraged for privilege escalation or data exfiltration. The issue is resolved by replacing the weak generation logic with cryptographically secure random bytes.

Affected products

Chamilo Chamilo LMS < 1.11.38, < 2.0.0-RC.3

Timeline

2026-04-10: advisory: Vendor advisory published via GitHub
2026-04-10: disclosed: CVE-2026-33710 published
2026-04-16: patched: NVD analysis and CPE information updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.