Quick answers
- Is CVE-2026-40291 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-40291 being exploited in the wild.
- How severe is CVE-2026-40291?
- High severity, with a CVSS score of 8.8, published 14 April 2026.
- Which products and versions are affected?
- Chamilo Lms < 2.0.0-RC.3.
- Is there a fix for CVE-2026-40291?
- A patch was published on 2022-04-01: Version 2.0.0-RC.3 released (based on GitHub tag date) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-40291 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-40291?
- Check whether you run Chamilo Lms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An insecure direct object modification vulnerability exists in the PUT /api/users/{id} endpoint of Chamilo LMS. The root cause is an insufficient security expression in the API Platform configuration (is_granted('EDIT', object)) which only validates that a user owns the record they are modifying, but fails to restrict which fields can be updated. Because the 'roles' field is included in the writable serialization group, an authenticated user with ROLE_STUDENT can submit a JSON payload to their own ID containing 'ROLE_ADMIN'. This results in full privilege escalation, granting the attacker administrative access to the entire platform. The issue is resolved in version 2.0.0-RC.3.
Affected products
- Chamilo Chamilo LMS < 2.0.0-RC.3
Timeline
- 2026-04-10: advisory: Vendor advisory published on GitHub
- 2026-04-14: disclosed: CVE published to NVD
- 2022-04-01: patched: Version 2.0.0-RC.3 released (based on GitHub tag date)