1. Home
  2. CVE Database
  3. CVE-2026-33706
HIGH · 7.1

CVE-2026-33706

Chamilo LMS is a learning management system. Prior to 1.11.38, any authenticated user with a REST API key can modify their own status field via the update_user_from_username endpoint. A student (statu...

Vulnerability Description

Chamilo LMS is a learning management system. Prior to 1.11.38, any authenticated user with a REST API key can modify their own status field via the update_user_from_username endpoint. A student (status=5) can change their status to Teacher/CourseManager (status=1), gaining course creation and management privileges. This vulnerability is fixed in 1.11.38.

CVSS Score

7.1

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
HIGH
Availability
NONE

Affected Products

VendorProductVersions
ChamiloChamilo Lms< 1.11.38

Related Weaknesses (CWE)

CWE-269

References

FAQ

What is CVE-2026-33706?

CVE-2026-33706 is a vulnerability with a CVSS score of 7.1 (HIGH). Chamilo LMS is a learning management system. Prior to 1.11.38, any authenticated user with a REST API key can modify their own status field via the update_user_from_username endpoint. A student (statu...

How severe is CVE-2026-33706?

CVE-2026-33706 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-33706?

Check the references section above for vendor advisories and patch information. Affected products include: Chamilo Chamilo Lms.