Vulnerability Description
Chamilo LMS is an open-source learning management system. From 2.0.0 until 2.0.1, `GET /user/{username}` is anonymously reachable and renders six user-editable profile fields (`firstname`, `lastname`, `competences`, `openarea`, `teach`, and `diplomas`) inside `{% autoescape false %}`, without server-side sanitization on the write path. A ROLE_STUDENT attacker can plant HTML in their own profile; self-registration, when enabled, lets an otherwise anonymous attacker obtain that role. The stored content executes in the browser of any visitor, including administrators, who follows the public profile link, potentially allowing account takeover through session, JWT, or `localStorage` exfiltration. This issue is fixed in version 2.0.1.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/chamilo/chamilo-lms/commit/0ba260a851ef48506814baa7a20534c8f0
- https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1
- https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-9833-c7cj-x9xm
FAQ
What is CVE-2026-45144?
CVE-2026-45144 is a vulnerability with a CVSS score of 8.9 (HIGH). Chamilo LMS is an open-source learning management system. From 2.0.0 until 2.0.1, `GET /user/{username}` is anonymously reachable and renders six user-editable profile fields (`firstname`, `lastname`,...
How severe is CVE-2026-45144?
CVE-2026-45144 has been rated HIGH with a CVSS base score of 8.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-45144?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.