Is CVE-2026-34602 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34602 being exploited in the wild.

How severe is CVE-2026-34602?

High severity, with a CVSS score of 7.1, published 14 April 2026.

Is there a fix for CVE-2026-34602?

A patch was published on 2026-04-01: Version 2.0.0-RC.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34602 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-34602?

Check whether you run Chamilo Lms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34602: Chamilo LMS IDOR in course enrollment API

CVE-2026-34602 · Severity: high · CVSS 7.1 · Published 2026-04-14

Chamilo LMS is an open-source platform used by educational institutions and companies to manage online learning and courses. A security flaw allows a logged-in user to bypass enrollment rules and sign themselves or any other person up for any course on the platform. This could lead to unauthorized access to sensitive course materials and disrupt the integrity of student enrollment records.

Technologies: Chamilo Lms. Vendors: Chamilo.

Quick answers

Is CVE-2026-34602 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34602 being exploited in the wild.
How severe is CVE-2026-34602?: High severity, with a CVSS score of 7.1, published 14 April 2026.
Which products and versions are affected?: Chamilo Lms < 2.0.0-RC.3.
Is there a fix for CVE-2026-34602?: A patch was published on 2026-04-01: Version 2.0.0-RC.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34602 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-34602?: Check whether you run Chamilo Lms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in the /api/course_rel_users API endpoint of Chamilo LMS. The backend fails to perform server-side authorization checks to verify if the requester has the permission to modify enrollment for the specified user ID provided in the request body. An authenticated attacker can exploit this by sending a POST request with a manipulated 'user' parameter to enroll themselves or others into any course. This vulnerability is rooted in the application trusting user-supplied input for user-course relationships without validating ownership or administrative privileges. The issue is resolved in version 2.0.0-RC.3 by implementing the CourseRelUserStateProcessor to enforce proper access controls.

Affected products

Chamilo Chamilo LMS < 2.0.0-RC.3

Timeline

2026-04-01: patched: Version 2.0.0-RC.3 released
2026-04-14: advisory: Vendor advisory and CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.