Chamilo vulnerabilities
Published CVEs affecting Chamilo products: 77 record(s), with severity, exploitation and fixes.
CVE-2026-1106
Medium · 5.4
CWE-266 Jan 17, 2026
Chamilo LMS Legal Consent SocialController.php deleteLegal improper authorization
A security flaw has been discovered in Chamilo LMS up to 2.0.0 Beta 1. This issue affects the function deleteLegal of the file src/CoreBundle/Controller/SocialController.php of the component Legal Consent Handler. Performing a manipulation of the argument userId results in improper authorization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-69581
Medium · 5.5
CWE-524 Jan 16, 2026
An issue was discovered in Chamillo LMS 1.11.2. The Social Network /personal_data…
An issue was discovered in Chamillo LMS 1.11.2. The Social Network /personal_data endpoint exposes full sensitive user information even after logout because proper cache-control is missing. Using the browser back button restores all personal data, allowing unauthorized users on the same device to view confidential information. This leads to profiling, impersonation, targeted attacks, and significant privacy risks.