Executive brief
Chamilo LMS is a platform used by educational institutions to manage online learning and courses. A security flaw allows any logged-in user, including students, to view the private contact information and account details of every other user on the system, including administrators. This could lead to the exposure of sensitive personal data like phone numbers and emails, and could be used to facilitate targeted phishing attacks against staff.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the User API of Chamilo LMS. The root cause is an insufficient authorization check where the 'GetCollection' operation only requires 'ROLE_USER' permissions, which is granted to all authenticated users including students. By sending a GET request to /api/users or /api/users/{id}, an attacker with low-level privileges can enumerate the entire user database and extract sensitive fields such as email addresses, phone numbers, and account roles. This issue affects versions up to 2.0.0-RC.2 and is resolved in version 2.0.0-RC.3 by implementing field-level and visibility filters.
Affected products
- Chamilo Chamilo LMS < 2.0.0-RC.3
Timeline
- 2026-03-23: patched: Fix committed to repository
- 2026-04-10: advisory: Vendor advisory published via GitHub
- 2026-04-10: disclosed: CVE published