CVE-2025-59544: 
Chamilo vulnerability analysis and mitigation

CVE-2025-59544 is a Missing Authorization vulnerability in Chamilo LMS that allows attackers to update the user category of any user by manipulating the category_id parameter without proper permission validation. It affects Chamilo LMS versions up to and including 1.11.32, and was disclosed on March 5–6, 2026. The vulnerability was patched in version 1.11.34. It carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is CWE-862 (Missing Authorization): the category update functionality in Chamilo LMS does not perform server-side authorization checks on the category_id parameter before processing a user's request to update their category. Because category_id values are numeric and incremental, an attacker can enumerate and brute-force valid IDs to modify the category of any user in the system. Exploitation requires only network access and a low-privilege authenticated session (per CVSS v3.1), though the CVSS v4.0 vector suggests the attack may be feasible without authentication. The security advisory was reported by Maheshkumar Darji of Bulwarkers (GitHub Advisory).

Successful exploitation allows an attacker to arbitrarily modify the category assignments of any user in the Chamilo LMS platform, potentially enabling unauthorized privilege escalation or disruption of access control settings tied to user categories. The integrity of user role and permission assignments is compromised, though there is no direct confidentiality or availability impact. The scope is limited to the affected Chamilo LMS instance, with no evidence of lateral movement potential beyond the application (GitHub Advisory, Red Hat CVE).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.041%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory, Red Hat CVE).

1. Reconnaissance: Identify a Chamilo LMS instance running version 1.11.32 or earlier, accessible over the network.
2. Authentication: Log in with any low-privilege user account on the target Chamilo LMS instance.
3. Identify the category update endpoint: Locate the functionality that allows a user to update their own category (e.g., a profile or account settings endpoint that accepts a category_id parameter).
4. Intercept and manipulate the request: Using a proxy tool such as Burp Suite, intercept the HTTP request sent when updating a category and observe the category_id parameter in the request body or query string.
5. Brute-force category IDs: Replace the category_id value with other numeric IDs (incrementing from 1 upward) to target categories belonging to other users, since no server-side authorization check is performed.
6. Submit modified requests: Send the manipulated requests to update the category of arbitrary users, achieving unauthorized modification of user category assignments across the platform (GitHub Advisory).

• Logs: Chamilo application logs showing repeated category update requests from a single user account targeting multiple different category_id values in rapid succession, suggesting brute-force enumeration.
• Logs: Unexpected category change events for users who did not initiate a category update, visible in audit or activity logs.
• Network: High volume of HTTP requests to the category update endpoint from a single source IP, particularly with sequentially incrementing category_id parameter values.
• Application: Unexplained changes to user category assignments across multiple accounts, especially for accounts belonging to administrators or privileged users (GitHub Advisory).

The vulnerability is patched in Chamilo LMS version 1.11.34, which adds server-side validation for the category_id parameter in the category update functionality (commit reference: Security: Add validation in personal course categories). Organizations should upgrade to version 1.11.34 or later immediately. As a temporary workaround for systems that cannot be patched right away, administrators should implement network-level access controls to restrict access to the category update endpoint and monitor application logs for suspicious category modification activity (GitHub Advisory, Chamilo v1.11.34 Release).