← Database

CVE-2026-33736

MEDIUM CVSS: 6.5 Published: 2026-04-10 Modified: 2026-06-17

Description

Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, any authenticated user (including ROLE_STUDENT) can enumerate all platform users and access personal information (email, phone, roles) via GET /api/users, including administrator accounts. This vulnerability is fixed in 2.0.0-RC.3.

Affected Platforms

Chamilo Chamilo Lms

Weakness Type

CWE-639

References