Executive brief
Chamilo LMS, a popular open-source learning management system, contains a flaw that allows students to grant themselves administrative rights. By sending a specifically crafted request to the platform's user profile interface, a student can change their own account role to 'Admin'. This gives the attacker full control over the entire platform, including the ability to access all student grades, personal data, and course materials.
Technical details
An insecure direct object modification vulnerability exists in the PUT /api/users/{id} endpoint of Chamilo LMS. The root cause is an insufficient security expression in the API Platform configuration (is_granted('EDIT', object)) which only validates that a user owns the record they are modifying, but fails to restrict which fields can be updated. Because the 'roles' field is included in the writable serialization group, an authenticated user with ROLE_STUDENT can submit a JSON payload to their own ID containing 'ROLE_ADMIN'. This results in full privilege escalation, granting the attacker administrative access to the entire platform. The issue is resolved in version 2.0.0-RC.3.
Affected products
- Chamilo Chamilo LMS < 2.0.0-RC.3
Timeline
- 2026-04-10: advisory: Vendor advisory published on GitHub
- 2026-04-14: disclosed: CVE published to NVD
- 2022-04-01: patched: Version 2.0.0-RC.3 released (based on GitHub tag date)