CVE-2026-114390: 
Chamilo vulnerability analysis and mitigation

CVE-2026-114390 is a missing authorization vulnerability in Chamilo LMS affecting versions 2.0.0-alpha.1 through 2.0.0-RC.2 (fixed in 2.0.0-RC.3). The flaw exists in legacy AJAX handlers under public/main/inc/ajax/ that lack proper access controls, allowing unauthenticated or low-privileged users to enumerate user names and download other learners' certificate PDFs. It was disclosed on October 21, 2026, and assigned a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, VulnCheck).

The root cause is CWE-862 (Missing Authorization): Chamilo's security.yaml configuration lacked a default-deny access control rule, meaning every route was publicly accessible unless the individual controller explicitly enforced authentication via #[IsGranted] or api_protect_*() calls. Specifically, the AJAX actions get_users_by_group_course (in usergroup.ajax.php), user_by_all_roles and teacher_to_basis_course (in user_manager.ajax.php), export_all_certificates (in gradebook.ajax.php), and display_sessions_courses/search_room (in course.ajax.php) performed no authentication checks before returning sensitive data. An attacker can exploit this by sending unauthenticated HTTP requests directly to these endpoints with appropriate parameters (e.g., a group_id POST parameter to usergroup.ajax.php) to receive JSON-encoded user data or trigger certificate PDF generation (GitHub Issue #7671, Vulnerable Code).

Successful exploitation allows unauthenticated network attackers to harvest full names and usernames of enrolled learners across courses and groups, and to download certificate PDFs belonging to other users via the export_all_certificates action. The confidentiality impact is limited to user PII (names) and certificate documents; there is no integrity or availability impact. While lateral movement is not directly enabled, the harvested user data could facilitate targeted phishing, credential stuffing, or social engineering attacks against the affected institution's learners (GitHub Advisory, VulnCheck).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The vulnerability is rated as automatable by NVD (no user interaction required, network-accessible), making it trivial to script bulk enumeration. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing Chamilo LMS instances running versions 2.0.0-alpha.1 through 2.0.0-RC.2 using search engines (e.g., Shodan, Censys) or by checking the Chamilo version page.
2. Target user enumeration endpoint: Send an unauthenticated HTTP POST request to /public/main/inc/ajax/usergroup.ajax.php with parameters action=get_users_by_group_course and a valid group_id value (iterable from 1 upward) to receive a JSON array of user names enrolled in that group.
3. Enumerate users by role: Send an unauthenticated HTTP POST to /public/main/inc/ajax/user_manager.ajax.php with action=user_by_all_roles to retrieve a list of users across all roles on the platform.
4. Harvest certificate PDFs: Send an unauthenticated HTTP GET to /public/main/inc/ajax/gradebook.ajax.php with action=export_all_certificates&cat_id=<category_id> to trigger bulk certificate PDF export for all learners in a gradebook category.
5. Collect teacher/coach PII: Send an unauthenticated GET to /public/main/inc/ajax/course.ajax.php with action=display_sessions_courses&session=<session_id> to retrieve course and coach name data for a given session (GitHub Issue #7671, Vulnerable Code).

• Network: Unauthenticated HTTP POST/GET requests to /public/main/inc/ajax/usergroup.ajax.php, /public/main/inc/ajax/user_manager.ajax.php, /public/main/inc/ajax/gradebook.ajax.php, or /public/main/inc/ajax/course.ajax.php from external or unexpected IP addresses; repeated sequential requests with incrementing group_id, cat_id, or session_id parameter values suggesting automated enumeration.
• Logs: Web server access logs showing requests to the above AJAX endpoints with no associated authenticated session cookie; HTTP 200 responses to these endpoints from unauthenticated clients; high-frequency requests to export_all_certificates action.
• File System: Unexpected certificate PDF files generated or accessed in bulk outside of normal usage patterns.

Upgrade Chamilo LMS to version 2.0.0-RC.3 or later, which includes commit 2861afd adding proper authorization checks to all affected AJAX handlers and Symfony controllers (RC.3 Release, Patch Commit). For systems that cannot be immediately patched, implement network-level access controls (e.g., WAF rules or web server configuration) to restrict unauthenticated access to the /public/main/inc/ajax/ directory. As an additional hardening measure, add a catch-all IS_AUTHENTICATED_FULLY rule in security.yaml for the /main/inc/ajax path prefix, being careful to preserve intentionally public routes (GitHub Issue #7671).

The vulnerability was originally reported by security researcher lighthousekeeper1212 via a GitHub issue in March 2026, who identified approximately 13 authorization vulnerabilities stemming from the same systemic misconfiguration. Chamilo maintainer ywarnier acknowledged the findings, noting the team was already aware of similar issues detected via Claude Code, and committed fixes in commit 2861afd before the RC.3 release. The maintainer noted that a blanket security.yaml deny-all rule was not feasible due to intentionally public routes (course catalogue, OAuth callbacks, etc.), and instead applied per-action authorization checks (GitHub Issue #7671).