CVE-2020-23128: 
Chamilo vulnerability analysis and mitigation

Chamilo LMS 1.11.10 contains a privilege escalation vulnerability (CVE-2020-23128) that allows a user with Sessions administrator privileges to create a new user and then escalate that user's privileges to administrator level through improper privilege management (NVD, AttackerKB).

The vulnerability exists in the user edit functionality of Chamilo LMS 1.11.10. A Sessions administrator can create a new user account and then modify the request body during the user edit operation to elevate the new user's privileges to administrator level. This is possible due to improper validation of privilege changes in the user edit function (ToanDang Blog).

The vulnerability allows privilege escalation from Sessions administrator to full administrator access. A malicious user could create new administrator accounts, potentially leading to complete compromise of the Chamilo LMS instance (NVD).