Is CVE-2026-34370 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34370 being exploited in the wild.

How severe is CVE-2026-34370?

Medium severity, with a CVSS score of 6.5, published 14 April 2026.

Is there a fix for CVE-2026-34370?

A patch was published on 2026-04-01: Version 2.0.0-RC.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34370 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-34370?

Check whether you run Chamilo Lms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34370: Chamilo LMS IDOR in notebook module

CVE-2026-34370 · Severity: medium · CVSS 6.5 · Published 2026-04-14

Chamilo LMS is an open-source platform used by educational institutions to manage online courses and student materials. A security flaw in the notebook feature allows any logged-in student to view the private notes of other students or instructors by simply changing a numeric ID in their web browser. This could lead to the exposure of sensitive personal information, private study materials, or instructor-only notes that were intended to remain confidential.

Technologies: Chamilo Lms. Vendors: Chamilo.

Quick answers

Is CVE-2026-34370 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34370 being exploited in the wild.
How severe is CVE-2026-34370?: Medium severity, with a CVSS score of 6.5, published 14 April 2026.
Which products and versions are affected?: Chamilo Lms < 2.0.0-RC.3.
Is there a fix for CVE-2026-34370?: A patch was published on 2026-04-01: Version 2.0.0-RC.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34370 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-34370?: Check whether you run Chamilo Lms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in the notebook module of Chamilo LMS due to missing authorization checks in the read path. While the application implements ownership verification for updating or deleting notes, the 'get_note_information()' function used by the 'editnote' action fails to verify if the requesting user owns the note associated with the provided 'notebook_id'. An authenticated attacker can exploit this by enumerating integer IDs to retrieve the full title and HTML body of any private note on the platform. The vulnerability is fixed in version 2.0.0-RC.3.

Affected products

Chamilo Chamilo LMS < 2.0.0-RC.3

Timeline

2026-04-01: patched: Version 2.0.0-RC.3 released
2026-04-14: advisory: Vendor advisory and CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.