CVE-2026-33736 chamilo CVE debrief

Who should care

Defenders responsible for Chamilo LMS deployments, especially those with low-privilege users or exposed /api/users endpoints, should assess exposure and apply the patch. They should also verify Chamilo LMS version, restrict access to /api/users endpoint, and monitor for unauthorized access attempts. Security teams and vulnerability management teams should review the vulnerability and its potential impacts on their systems.

Why it matters

CVE-2026-33736 allows authenticated users to access sensitive information, requiring defenders to verify exposure, apply patches, and restrict access to mitigate potential impacts.

• Potential unauthorized access to user personal information
• Possible enumeration of all platform users
• Required verification of Chamilo LMS version and exposure
• Necessity to restrict access to /api/users endpoint

Technical summary

CVE-2026-33736 is a vulnerability in Chamilo LMS that allows authenticated users to enumerate all platform users and access personal information via GET /api/users. The vulnerability is fixed in version 2.0.0-RC.3. Affected deployments should assess exposure and apply the patch. Defenders should verify Chamilo LMS version and restrict access to /api/users endpoint to mitigate potential impacts. This vulnerability has a CVSS score of 6.5 and a severity of MEDIUM. The vulnerability allows authenticated users, including students, to access sensitive information such as email, phone number, and roles.

Defensive priority

Defenders should prioritize verifying exposure of Chamilo LMS user enumeration and personal information access, especially for unauthenticated or low-privilege users, and apply the patch from version 2.0.0-RC.3 if vulnerable.

Recommended defensive actions

• Verify Chamilo LMS version and apply patch from 2.0.0-RC.3 if vulnerable
• Restrict access to /api/users endpoint
• Monitor for unauthorized access attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fixed version. Additional information comes from source references on GitHub, including a patch commit and a vendor advisory. Defenders should verify Chamilo LMS version, assess exposure, and apply the patch from version 2.0.0-RC.3 if vulnerable. Evidence limits suggest confirming affected scope and reviewing compensating controls.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.