CVE-2025-52469: 
Chamilo vulnerability analysis and mitigation

CVE-2025-52469 is a friend request workflow bypass vulnerability in Chamilo LMS's social network module that allows authenticated users to forcibly add any user as a friend without consent. It affects Chamilo LMS versions up to and including 1.11.28, and was disclosed on March 2, 2026. The vulnerability was patched in version 1.11.30. It carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-841 (Improper Enforcement of Behavioral Workflow): the AJAX endpoint /main/inc/ajax/social.ajax.php?a=add_friend&friend_id=<ID>&is_my_friend=friend processes friend-addition requests without verifying that a prior friend request was sent or accepted by the target user, and without validating that the target user even exists (GitHub Advisory). An attacker with a valid authenticated session (ch_sid) can craft a direct GET request to this endpoint with an arbitrary friend_id value, bypassing the normal send-and-accept workflow entirely. The fix introduced a SocialManager::hasInvitationByUser() check that verifies a pending invitation exists in the database before processing the friend relationship, and also casts friend_id to an integer to prevent type manipulation (Patch Commit).

Successful exploitation allows an authenticated attacker to unilaterally establish friend relationships with any user on the platform — including non-existent user IDs — without the target's knowledge or consent. This grants the attacker unauthorized access to content restricted to "friends only" (confidentiality impact), pollutes victim friend lists with forged entries (integrity impact), and enables social engineering or impersonation by fabricating apparent social relationships. There is no availability impact, and exploitation is limited to the Chamilo platform's social module scope (GitHub Advisory).

A proof-of-concept exploit is publicly referenced in the GitHub Security Advisory, demonstrating the attack on versions 1.11.26 and 1.11.28 (GitHub Advisory). There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.027% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Authenticate: Log in to a vulnerable Chamilo LMS instance (version ≤ 1.11.28) with any valid user account to obtain a session cookie (ch_sid).
2. Enumerate user IDs: Optionally enumerate valid user IDs by iterating over friend_id values (e.g., 1 through N), as the endpoint does not validate user existence.
3. Craft malicious request: Send a direct GET request to the vulnerable AJAX endpoint: GET /main/inc/ajax/social.ajax.php?a=add_friend&friend_id=<TARGET_ID>&is_my_friend=friend with the authenticated session cookie included.
4. Bypass workflow: The server processes the request without checking for a prior pending invitation, immediately establishing a bidirectional friend relationship between the attacker and the target.
5. Access restricted content: With the forced friendship established, access any content on the platform that is restricted to "friends only," or leverage the fabricated relationship for social engineering purposes (GitHub Advisory).

• Network: Unusual volume of GET requests to /main/inc/ajax/social.ajax.php?a=add_friend from a single authenticated session, particularly with sequentially or randomly varying friend_id values.
• Logs: Web server access logs showing repeated calls to the add_friend AJAX action with different friend_id parameters in a short time window from the same session or IP address.
• Application: Unexpected or unexplained friend relationships appearing in user accounts, particularly connections that users did not initiate or accept; friend list entries referencing non-existent user IDs.

Upgrade Chamilo LMS to version 1.11.30 or later, which introduces a server-side check (SocialManager::hasInvitationByUser()) to verify that a pending invitation exists before processing any friend-addition request (Chamilo Release, Patch Commit). For environments unable to upgrade immediately, restrict network access to Chamilo instances to authorized users only, and monitor AJAX endpoint activity for suspicious friend request patterns. Administrators should also audit existing friend relationships for unauthorized entries that may have been created prior to patching.

The vulnerability was reported by security researcher NaklehZeidan21 and remediated by Chamilo developer AngelFQC, as credited in the official GitHub Security Advisory (GitHub Advisory). No significant broader media coverage or notable community commentary beyond the advisory has been identified.