CVE-2026-33706 chamilo CVE debrief

Who should care

Defenders responsible for Chamilo LMS installations should assess exposure and apply the patch. This includes administrators, security teams, and IT personnel managing the learning management system.

Why it matters

CVE-2026-33706 is a high-severity vulnerability in Chamilo LMS that allows authenticated users to modify their own status field, potentially gaining course creation and management privileges. Defenders should prioritize verifying exposure and applying the patch to prevent exploitation.

• Elevation of privileges for authenticated users with a REST API key.
• Potential unauthorized course creation and management.
• Increased risk of malicious activity, such as unauthorized changes to user status or course content.
• Verification of exposure and patch application priority.

Technical summary

CVE-2026-33706 is a high-severity vulnerability in Chamilo LMS, allowing authenticated users with a REST API key to modify their own status field via the update_user_from_username endpoint. This could allow a student to change their status to Teacher/CourseManager, gaining course creation and management privileges. The vulnerability is fixed in version 1.11.38. Defenders should prioritize verifying exposure and applying the patch to prevent exploitation. This includes verifying the installed version of Chamilo LMS and upgrading to version 1.11.38 or later.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch, as authenticated users with a REST API key can exploit this vulnerability to gain elevated privileges.

Recommended defensive actions

• Verify exposure by checking if the installed version of Chamilo LMS is prior to 1.11.38.
• Apply the patch by upgrading to Chamilo LMS version 1.11.38 or later.
• Restrict access to the REST API to prevent unauthorized users from exploiting the vulnerability.
• Monitor for suspicious activity, such as unexpected changes to user status or course creation.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The vendor has released a patch, which is included in version 1.11.38. Defenders should verify exposure by checking the installed version of Chamilo LMS and apply the patch by upgrading to version 1.11.38 or later. The vulnerability allows authenticated users with a REST API key to modify their own status field, potentially gaining course creation and management privileges.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.