Executive brief
Chamilo LMS is an open-source platform used by educational institutions to manage online courses and student materials. A security flaw in the notebook feature allows any logged-in student to view the private notes of other students or instructors by simply changing a numeric ID in their web browser. This could lead to the exposure of sensitive personal information, private study materials, or instructor-only notes that were intended to remain confidential.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the notebook module of Chamilo LMS due to missing authorization checks in the read path. While the application implements ownership verification for updating or deleting notes, the 'get_note_information()' function used by the 'editnote' action fails to verify if the requesting user owns the note associated with the provided 'notebook_id'. An authenticated attacker can exploit this by enumerating integer IDs to retrieve the full title and HTML body of any private note on the platform. The vulnerability is fixed in version 2.0.0-RC.3.
Affected products
- Chamilo Chamilo LMS < 2.0.0-RC.3
Timeline
- 2026-04-01: patched: Version 2.0.0-RC.3 released
- 2026-04-14: advisory: Vendor advisory and CVE published