CVE-2026-34602: Chamilo LMS Auth Bypass Vulnerability

CVE-2026-34602 Overview

Chamilo LMS, an open-source learning management system, contains an Insecure Direct Object Reference (IDOR) vulnerability in versions prior to 2.0.0-RC.3. The /api/course_rel_users endpoint fails to implement proper authorization checks, allowing an authenticated attacker to manipulate the user parameter in request bodies to enroll arbitrary users into any course without proper authorization. This vulnerability enables unauthorized manipulation of user-course relationships, potentially granting unintended access to course materials, bypassing enrollment controls, and compromising overall platform integrity.

Critical Impact

Authenticated attackers can enroll any user into any course without authorization, bypassing enrollment controls and potentially exposing restricted educational content to unauthorized users.

Affected Products

• Chamilo LMS versions prior to 2.0.0-RC.3
• All installations using the vulnerable /api/course_rel_users endpoint
• Self-hosted and cloud-based Chamilo LMS deployments running unpatched versions

Discovery Timeline

• April 14, 2026 - CVE-2026-34602 published to NVD
• April 14, 2026 - Last updated in NVD database

Technical Details for CVE-2026-34602

Vulnerability Analysis

This vulnerability falls under CWE-639 (Authorization Bypass Through User-Controlled Key), a common weakness where the application uses user-controlled input to directly access objects without verifying that the user has proper authorization. In the context of Chamilo LMS, the /api/course_rel_users endpoint accepts a user parameter in the request body that specifies which user should be enrolled in a course. The backend trusts this user-supplied input without performing server-side verification to confirm whether the requester owns the referenced user ID or has administrative permissions to act on behalf of other users.

The attack is network-accessible and requires only low-privilege authenticated access to exploit. An attacker with a basic user account can craft malicious API requests that reference other users' IDs, effectively enrolling them in courses they did not request access to. This could be leveraged to grant unauthorized access to premium or restricted course content, manipulate academic records, or disrupt the integrity of the learning management platform.

Root Cause

The root cause of this vulnerability is the absence of proper authorization validation in the API endpoint handler. The application directly uses the user parameter from the request body to create user-course relationships without verifying that the authenticated user has the authority to perform enrollment actions for the specified user ID. This trust in client-supplied data without server-side authorization checks is a fundamental security flaw that enables IDOR attacks.

Attack Vector

The attack vector is network-based, requiring an authenticated session with the Chamilo LMS platform. An attacker would first authenticate to the system with valid credentials (even a low-privilege student account), then craft a POST request to the /api/course_rel_users endpoint with a modified user parameter containing another user's ID. Because the backend performs no ownership or permission validation, the request is processed successfully, enrolling the target user in the specified course.

The vulnerability enables several malicious scenarios: enrolling privileged users into courses to potentially expose their activity, enrolling oneself into restricted courses by manipulating course relationship data, or disrupting legitimate enrollment workflows by making unauthorized changes to user-course associations.

Detection Methods for CVE-2026-34602

Indicators of Compromise

• Unusual patterns of course enrollment activity, particularly bulk enrollments or enrollments occurring outside normal business hours
• API requests to /api/course_rel_users where the authenticated user ID does not match the user parameter in the request body
• Multiple enrollment changes originating from a single user session affecting different user accounts
• Audit log entries showing course enrollments for users who did not initiate the enrollment request

Detection Strategies

• Implement API request logging that captures both the authenticated user identity and the user parameter value to identify mismatches
• Deploy web application firewall (WAF) rules to flag requests where authenticated session user IDs differ from API body parameters
• Enable Chamilo LMS audit logging to track all course enrollment modifications with full request context
• Monitor for anomalous spikes in enrollment API activity that could indicate exploitation attempts

Monitoring Recommendations

• Review Chamilo LMS access logs regularly for suspicious patterns in /api/course_rel_users endpoint access
• Configure alerting for enrollment events where the enrolling user differs from the enrolled user
• Implement real-time monitoring of API endpoints handling user-object relationships for potential IDOR exploitation

How to Mitigate CVE-2026-34602

Immediate Actions Required

• Upgrade Chamilo LMS to version 2.0.0-RC.3 or later immediately
• Review recent enrollment records for any unauthorized or suspicious course enrollments
• Audit API access logs for evidence of exploitation attempts targeting the /api/course_rel_users endpoint
• Consider temporarily restricting API access to the vulnerable endpoint until patching is complete

Patch Information

The vulnerability has been fixed in Chamilo LMS version 2.0.0-RC.3. The fix implements proper server-side authorization checks to verify that the authenticated user has permission to perform enrollment actions for the specified user ID. Multiple commits address this vulnerability, including the primary security fix and supporting updates. The GitHub Release v2.0.0-RC.3 contains all necessary fixes.

For detailed vulnerability information, refer to the GitHub Security Advisory GHSA-x373-8j9j-g5pj.

Workarounds

• Implement network-level access controls to restrict API access to trusted IP ranges or internal networks only
• Deploy a web application firewall with custom rules to validate that the authenticated user matches the user parameter in enrollment API requests
• Disable or restrict access to the /api/course_rel_users endpoint until the patch can be applied
• Enable enhanced logging and monitoring to detect potential exploitation attempts while operating in an unpatched state

# Example: Restrict API access via web server configuration (Apache)
<Location "/api/course_rel_users">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Location>