Executive brief
Chamilo LMS is an open-source platform used by educational institutions and companies to manage online learning and courses. A security flaw allows a logged-in user to bypass enrollment rules and sign themselves or any other person up for any course on the platform. This could lead to unauthorized access to sensitive course materials and disrupt the integrity of student enrollment records.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the /api/course_rel_users API endpoint of Chamilo LMS. The backend fails to perform server-side authorization checks to verify if the requester has the permission to modify enrollment for the specified user ID provided in the request body. An authenticated attacker can exploit this by sending a POST request with a manipulated 'user' parameter to enroll themselves or others into any course. This vulnerability is rooted in the application trusting user-supplied input for user-course relationships without validating ownership or administrative privileges. The issue is resolved in version 2.0.0-RC.3 by implementing the CourseRelUserStateProcessor to enforce proper access controls.
Affected products
- Chamilo Chamilo LMS < 2.0.0-RC.3
Timeline
- 2026-04-01: patched: Version 2.0.0-RC.3 released
- 2026-04-14: advisory: Vendor advisory and CVE published
References
- https://github.com/chamilo/chamilo-lms/commit/2a9f060fa9d50fc9a92ed93af774d2619642df92
- https://github.com/chamilo/chamilo-lms/commit/bd2ba34c2e74475587e38c74c90c2934e69c8779
- https://github.com/chamilo/chamilo-lms/commit/c9c30cdc48afae57cd6ab012ae2eceafd351a40e
- https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3
- https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-x373-8j9j-g5pj