CVE-2026-33702 chamilo CVE debrief

Who should care

Defenders responsible for Chamilo LMS instances, particularly those with multiple users enrolled in courses, should assess exposure and apply patches to prevent unauthorized Learning Path progress modifications.

Why it matters

CVE-2026-33702 is an Insecure Direct Object Reference (IDOR) vulnerability in Chamilo LMS that allows authenticated users to modify Learning Path progress of other users. Defenders should prioritize verifying exposure and applying patches to prevent unauthorized modifications.

• Unauthorized modification of Learning Path progress
• Potential for inaccurate score, status, completion, and time tracking
• Increased risk of Learning Path progress tampering
• Need for verification of user access controls

Technical summary

The lp_ajax_save_item.php endpoint in Chamilo LMS accepts a uid parameter directly from $_REQUEST and uses it to load and modify another user's Learning Path progress without verifying the requesting user matches the target user ID. This allows an authenticated user enrolled in a course to overwrite another user's Learning Path progress, including score, status, completion, and time. The vulnerability is fixed in versions 1.11.38 and 2.0.0-RC.3. Defenders should prioritize verifying exposure and applying patches to prevent unauthorized Learning Path progress modifications.

Defensive priority

Defenders should prioritize verifying exposure and applying patches to prevent unauthorized Learning Path progress modifications.

Recommended defensive actions

• Verify if Chamilo LMS instances are exposed to the vulnerability
• Apply patches to update to version 1.11.38 or 2.0.0-RC.3
• Monitor Learning Path progress for unauthorized modifications
• Restrict access to Learning Path progress saving endpoint
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source references provide details on the vulnerability and patches. Additional information on potential exploitation or impact is limited. Defenders should verify exposure and apply patches to prevent unauthorized Learning Path progress modifications. The lp_ajax_save_item.php endpoint in Chamilo LMS accepts a uid parameter directly from $_REQUEST and uses it to load and modify another user's Learning Path progress without verifying the requesting user matches the target user ID. Chamilo LMS versions 1.11.38 and 2.0

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.