CVE-2026-33708 chamilo CVE debrief

Who should care

Defenders responsible for Chamilo LMS instances, particularly those with student or user data, should assess exposure and apply the patch to prevent unauthorized access to sensitive user information.

Why it matters

CVE-2026-33708 is a vulnerability in Chamilo LMS that allows unauthorized access to personal information of any user through the get_user_info_from_username REST API endpoint. Defenders should prioritize verifying exposure and applying the patch to prevent potential data breaches or misuse of user data.

• Potential unauthorized access to sensitive user information
• Increased risk of data breaches or misuse of user data
• Need for verification of exposure and application of the patch
• Potential impact on user trust and confidentiality

Technical summary

The get_user_info_from_username REST API endpoint in Chamilo LMS prior to version 1.11.38 returns personal information of any user to any authenticated user, including students, without authorization checks. This vulnerability allows access to sensitive user information, including email, first name, last name, user ID, and active status. Defenders should prioritize verifying exposure and applying the patch to prevent potential data breaches or misuse of user data. The vulnerability is fixed in version 1.11.38 of Chamilo LMS.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch, as the vulnerability allows access to sensitive user information.

Recommended defensive actions

• Verify exposure by checking if the Chamilo LMS instance is using a version prior to 1.11.38
• Apply the patch by upgrading to Chamilo LMS version 1.11.38 or later
• Monitor API requests to the get_user_info_from_username endpoint for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The vulnerability is confirmed in Chamilo LMS versions prior to 1.11.38. Defenders should verify exposure by checking the version of Chamilo LMS in use and apply the patch by upgrading to version 1.11.38 or later. Evidence is limited to public CVE and NVD information; further verification may be necessary.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.