CVE-2026-33703: Chamilo LMS Information Disclosure Flaw

CVE-2026-33703 Overview

CVE-2026-33703 is an Insecure Direct Object Reference (IDOR) vulnerability affecting Chamilo LMS, an open-source learning management system. The vulnerability exists in the /social-network/personal-data/{userId} endpoint, which allows any authenticated user to access full personal data and API tokens of arbitrary users by simply modifying the userId parameter in the request. This critical access control flaw enables mass disclosure of sensitive user information and credentials, potentially resulting in a full platform data breach.

Critical Impact

Authenticated attackers can enumerate and extract personal data and API tokens for all users on the platform, enabling account takeover, credential theft, and complete data exfiltration.

Affected Products

• Chamilo LMS 2.0.0-alpha1 through 2.0.0-alpha5
• Chamilo LMS 2.0.0-beta1 through 2.0.0-beta3
• Chamilo LMS 2.0.0-rc1 and 2.0.0-rc2

Discovery Timeline

• 2026-04-10 - CVE-2026-33703 published to NVD
• 2026-04-16 - Last updated in NVD database

Technical Details for CVE-2026-33703

Vulnerability Analysis

This vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key), which occurs when an application uses user-controllable input to directly reference objects without proper authorization checks. In the case of Chamilo LMS, the /social-network/personal-data/{userId} endpoint accepts a userId parameter that directly maps to user records in the database. The application fails to verify that the requesting user has authorization to view the targeted user's data, allowing any authenticated user to access another user's complete personal information and API tokens.

The attack requires network access and low-privilege authenticated access to the platform. Once authenticated, an attacker can systematically enumerate user IDs to harvest personal data across the entire user base. The exposure of API tokens is particularly concerning as it enables subsequent attacks including session hijacking and unauthorized API access on behalf of compromised users.

Root Cause

The root cause is a missing authorization check in the personal data endpoint handler. The application directly uses the user-supplied userId parameter to query and return user data without validating whether the authenticated session belongs to the requested user or has administrative privileges to view other users' data. This represents a fundamental failure in implementing proper access control at the application layer.

Attack Vector

The attack is executed over the network by an authenticated user. The attacker authenticates to the Chamilo LMS platform with any valid user account, then crafts requests to the vulnerable endpoint while incrementing or modifying the userId parameter. Each successful request returns the complete personal data and API tokens for the targeted user.

The vulnerability manifests when authenticated requests are made to the /social-network/personal-data/{userId} endpoint with arbitrary user ID values. Since no authorization check validates ownership or administrative privileges, the API returns sensitive data for any valid user ID. Attackers can automate enumeration of user IDs to perform mass data extraction. See the GitHub Security Advisory for additional technical details.

Detection Methods for CVE-2026-33703

Indicators of Compromise

• Sequential or enumerated access patterns to /social-network/personal-data/ endpoint with varying user IDs from a single session
• Unusual volume of requests to the personal data endpoint from non-administrative user accounts
• Access logs showing a user retrieving personal data for user IDs other than their own authenticated session
• API token usage from unexpected IP addresses or geographic locations following data endpoint access

Detection Strategies

• Implement web application firewall (WAF) rules to detect rapid enumeration patterns against the vulnerable endpoint
• Create SIEM correlation rules to identify when a single authenticated session accesses multiple user profiles within a short time window
• Monitor application logs for access to /social-network/personal-data/{userId} where the userId parameter does not match the authenticated user's ID
• Deploy anomaly detection to flag unusual API endpoint access patterns from low-privilege accounts

Monitoring Recommendations

• Enable detailed access logging for all social network and personal data endpoints in Chamilo LMS
• Configure alerting for bulk data access patterns that may indicate automated enumeration
• Review authentication and API token usage logs for signs of credential compromise following potential exploitation
• Implement rate limiting and monitoring on sensitive user data endpoints

How to Mitigate CVE-2026-33703

Immediate Actions Required

• Upgrade Chamilo LMS to version 2.0.0-RC.3 or later immediately
• Audit access logs for the /social-network/personal-data/ endpoint to identify potential exploitation
• Force rotation of API tokens for all users as a precautionary measure if exploitation is suspected
• Review and revoke any suspicious active sessions across the platform

Patch Information

The vulnerability is fixed in Chamilo LMS version 2.0.0-RC.3. Organizations should update to this version or later to remediate the vulnerability. Detailed information about the fix is available in the GitHub Security Advisory.

Workarounds

• Implement network-level access controls to restrict access to the vulnerable endpoint until patching is complete
• Deploy a web application firewall (WAF) rule to block or rate-limit requests to /social-network/personal-data/ with parameter tampering patterns
• Temporarily disable the social network personal data feature if business operations permit
• Restrict platform access to trusted network segments while awaiting patch deployment

# Example: Restrict access to vulnerable endpoint via nginx configuration
location ~ ^/social-network/personal-data/ {
    # Allow only from trusted admin network until patch is applied
    allow 10.0.0.0/8;
    deny all;
    
    # Alternatively, disable endpoint entirely
    # return 403;
}