CVE-2026-33703 chamilo CVE debrief

Who should care

Defenders responsible for Chamilo LMS instances, security teams, and administrators of learning management systems should assess exposure and prioritize remediation. They should verify whether affected product deployments exist in managed environments and review compensating controls for exposed systems while remediation is scheduled and verified. Security teams must track exceptions, retest remediated assets, and close the item only after evidence is well

Why it matters

CVE-2026-33703 is a high-severity vulnerability in Chamilo LMS that allows authenticated users to access arbitrary user data, potentially leading to a full platform data breach. Defenders should prioritize verifying exposure and upgrading to the fixed version.

• Mass disclosure of sensitive user information and credentials
• Potential for full platform data breach
• Verification of exposure to authenticated users
• Prioritization of upgrading to version 2.0.0-RC.3 or later

Technical summary

The vulnerability exists in the /social-network/personal-data/{userId} endpoint, allowing authenticated users to access full personal data and API tokens of arbitrary users by modifying the userId parameter. This Insecure Direct Object Reference (IDOR) vulnerability affects Chamilo LMS versions prior to 2.0.0-RC.3, potentially leading to mass disclosure of sensitive user information and credentials. Defenders should assess exposure and prioritize remediation to prevent full platform data breaches. The vulnerability allows arbitrary user data access without specific exploit requirements.

Defensive priority

Defenders should prioritize verifying exposure of Chamilo LMS instances to authenticated users and upgrading to version 2.0.0-RC.3 or later.

Recommended defensive actions

• Verify Chamilo LMS instances for exposure to authenticated users
• Upgrade to version 2.0.0-RC.3 or later
• Monitor for suspicious activity on the /social-network/personal-data/{userId} endpoint
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fixed version. The vulnerability exists in Chamilo LMS versions prior to 2.0.0-RC.3. Evidence is limited to public CVE and NVD information. Defenders should verify exposure and review vendor guidance for affected deployments. Limited source detail is available; explicit evidence limits apply.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.