CVE-2026-33706: Privilege Escalation in Chamilo LMS

The primary impact of CVE-2026-33706 is the unauthorized elevation of user privileges. An attacker, already authenticated within the Chamilo LMS, can leverage the REST API to change their user status from a standard student (status=5) to a Teacher or Course Manager (status=1). This grants them the ability to create, modify, and delete courses, manage users, and potentially access sensitive data within the learning environment. The blast radius extends to all courses and users managed by the compromised account, potentially disrupting learning activities and compromising data integrity. While not directly leading to system compromise, the ability to control course content and user access represents a significant security risk.

1. Reserved2026-03-23
2. Published2026-04-10
3. Modified2026-04-14
4. EPSS updated2026-04-18

The definitive mitigation for CVE-2026-33706 is to upgrade Chamilo LMS to version 1.11.38 or later. If an immediate upgrade is not feasible, consider implementing temporary workarounds. Restricting access to the updateuserfrom_username endpoint via a web application firewall (WAF) or proxy server can help prevent unauthorized status modifications. Review and audit existing REST API key permissions to ensure they adhere to the principle of least privilege. Regularly monitor user activity logs for suspicious changes to user statuses. After upgrading to 1.11.38, verify the fix by attempting to modify a user's status via the REST API with a standard user account; the request should be rejected.