Is CVE-2026-33736 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33736 being exploited in the wild.

How severe is CVE-2026-33736?

Medium severity, with a CVSS score of 6.5, published 10 April 2026.

Which products and versions are affected?

Chamilo Chamilo LMS < 2.0.0-RC.3.

Is there a fix for CVE-2026-33736?

A patch was published on 2026-03-23: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33736 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-33736?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33736: Chamilo LMS authorization bypass in User API

Q: Which products and versions are affected?

Chamilo Chamilo LMS < 2.0.0-RC.3.

Q: Is there a fix for CVE-2026-33736?

A patch was published on 2026-03-23: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-33736 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-33736?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33736 · Severity: medium · CVSS 6.5 · Published 2026-04-10

Chamilo LMS is a platform used by educational institutions to manage online learning and courses. A security flaw allows any logged-in user, including students, to view the private contact information and account details of every other user on the system, including administrators. This could lead to the exposure of sensitive personal data like phone numbers and emails, and could be used to facilitate targeted phishing attacks against staff.

Quick answers

Is CVE-2026-33736 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33736 being exploited in the wild.
How severe is CVE-2026-33736?: Medium severity, with a CVSS score of 6.5, published 10 April 2026.
Which products and versions are affected?: Chamilo Chamilo LMS < 2.0.0-RC.3.
Is there a fix for CVE-2026-33736?: A patch was published on 2026-03-23: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33736 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-33736?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in the User API of Chamilo LMS. The root cause is an insufficient authorization check where the 'GetCollection' operation only requires 'ROLE_USER' permissions, which is granted to all authenticated users including students. By sending a GET request to /api/users or /api/users/{id}, an attacker with low-level privileges can enumerate the entire user database and extract sensitive fields such as email addresses, phone numbers, and account roles. This issue affects versions up to 2.0.0-RC.2 and is resolved in version 2.0.0-RC.3 by implementing field-level and visibility filters.

Affected products

Chamilo Chamilo LMS < 2.0.0-RC.3

Timeline

2026-03-23: patched: Fix committed to repository
2026-04-10: advisory: Vendor advisory published via GitHub
2026-04-10: disclosed: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.