CVE-2026-30876: 
Chamilo vulnerability analysis and mitigation

CVE-2026-30876 is a user enumeration vulnerability in Chamilo LMS (Learning Management System) that allows unauthenticated remote attackers to determine whether specific usernames exist in the system by observing discrepancies in application responses to login attempts. It affects all Chamilo LMS versions prior to 1.11.36 and was published on March 16, 2026, with the patch released on March 8, 2026 in version 1.11.36. The vulnerability was reported by researcher "popcorn94" and assigned a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-204 (Observable Response Discrepancy), where the application returns distinguishably different responses when a valid versus an invalid username is submitted during authentication. An unauthenticated attacker can exploit this by submitting login requests with candidate usernames and analyzing the response content, timing, or status codes to infer whether an account exists. No authentication, special privileges, or user interaction is required, and the attack can be conducted entirely over the network with low complexity (GitHub Advisory).

Successful exploitation allows attackers to compile a list of valid usernames registered in the Chamilo LMS platform, which can then be leveraged for credential stuffing, brute-force password attacks, or targeted social engineering campaigns against identified users. The vulnerability impacts confidentiality only (no integrity or availability impact), and while it does not directly grant system access, it significantly lowers the barrier for follow-on attacks against the platform and its users (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation as of the time of disclosure (Feedly). The EPSS score is approximately 0.042%, reflecting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Despite the low current exploitation evidence, the attack requires no authentication and is automatable at scale, making it a viable tool for opportunistic attackers targeting educational institutions using Chamilo LMS.

1. Reconnaissance: Identify internet-facing Chamilo LMS instances running versions prior to 1.11.36 using search engines (e.g., Shodan, Censys) or by browsing to the login page and checking version indicators.
2. Prepare username wordlist: Compile a list of candidate usernames (e.g., common names, email prefixes, institutional naming conventions) to test against the target.
3. Submit login requests: Automate HTTP POST requests to the Chamilo login endpoint (e.g., /index.php) with each candidate username and an arbitrary password.
4. Analyze response discrepancies: Compare server responses (e.g., response body content, error messages, HTTP status codes, or response timing) for each username submission — valid usernames will produce a distinguishably different response than invalid ones.
5. Compile valid usernames: Record all usernames that trigger the "valid user" response pattern to build a confirmed account list for use in subsequent credential stuffing or targeted attacks (GitHub Advisory).

• Network: High volume of HTTP POST requests to the Chamilo login endpoint (e.g., /index.php) from a single IP or small range of IPs in a short time window, especially with varying usernames and a fixed or common password.
• Logs: Web server access logs showing repeated authentication attempts with many different usernames, particularly with consistent user-agent strings or request patterns indicative of automation.
• Logs: Application logs showing a large number of failed login attempts interspersed with occasional "valid username" response patterns, suggesting systematic enumeration rather than normal user behavior.
• Network: Unusual geographic origins or known datacenter/VPN IP ranges making repeated requests to the login page.

The primary remediation is to upgrade Chamilo LMS to version 1.11.36 or later, which was released on March 8, 2026, as a security-focused release (GitHub Release). As interim mitigations, administrators should implement rate limiting and account lockout policies on the login endpoint to slow automated enumeration attempts, and deploy a web application firewall (WAF) to detect and block high-frequency login request patterns. Monitoring authentication logs for anomalous patterns consistent with username enumeration is also recommended (GitHub Advisory, Feedly).