Chamilo LMS has a REST API Self-Privilege Escalation (Student → Teacher)

This vulnerability allows authenticated users with a REST API key to manipulate their own user status within the Chamilo LMS. The most significant impact arises when a standard user (typically with a 'student' status) can change their status to 'Teacher/CourseManager'. This elevation grants the attacker the ability to create and manage courses, potentially adding malicious content, enrolling unauthorized users, or modifying existing course materials. The blast radius extends to the entire course catalog and potentially the integrity of the learning environment, as an attacker could compromise the entire system through a single, authenticated user account. This is particularly concerning in multi-user environments where a compromised account could be used to gain access to sensitive student data or administrative functions.

1. Reserviert2026-03-23
2. Veröffentlicht2026-04-10
3. Geändert2026-04-14
4. EPSS aktualisiert2026-04-18

The primary mitigation for CVE-2026-33706 is to upgrade Chamilo LMS to version 1.11.38 or later. If an immediate upgrade is not feasible due to compatibility concerns or system downtime constraints, consider restricting access to the REST API endpoints, specifically the updateuserfrom_username endpoint. Implement strict authentication and authorization controls to ensure only authorized users can access and modify user profiles. Review existing REST API keys and revoke any that are no longer needed or suspect. After upgrading, confirm the fix by attempting to modify a user's status via the REST API with a standard user account; the modification should be denied.