CVE-2026-33702: 
Chamilo vulnerability analysis and mitigation

CVE-2026-33702 is an Insecure Direct Object Reference (IDOR) vulnerability in Chamilo LMS affecting the Learning Path progress saving endpoint. It allows any authenticated user enrolled in a course to overwrite another user's Learning Path progress — including scores, completion status, and time — by manipulating the uid parameter in requests to lp_ajax_save_item.php. Affected versions include all Chamilo LMS releases prior to 1.11.38 (1.x branch) and all 2.0.0 pre-release versions up to but not including 2.0.0-RC.3. The vulnerability was reported on 2026-03-11 and publicly disclosed on 2026-04-10. It carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory).

The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key). In main/lp/lp_ajax_save_item.php, the uid parameter is read directly from $_REQUEST and passed to the save_item() function as the target user ID without any verification that it matches the currently authenticated user (api_get_user_id()). The only access control present is api_protect_course_script(), which only verifies course enrollment — not user identity. Once the attacker-controlled $user_id is passed to learnpath::getLpFromSession() and subsequently to the learnpath constructor, the victim's LP view record is loaded from the database and modified via set_score(), set_status(), set_time(), and save_item(). Exploitation requires only a valid authenticated session and knowledge of another user's numeric ID (GitHub Advisory, Patch Commit 1).

Successful exploitation allows any enrolled course participant to arbitrarily overwrite another user's Learning Path progress data, including scores, completion status, time spent, and other assessment metrics. This directly compromises the integrity of educational records, potentially affecting course grading, certifications, and compliance audits. There is no confidentiality impact (no data is disclosed), but availability is marginally affected as legitimate progress data can be destroyed or corrupted. The vulnerability does not enable lateral movement or remote code execution (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.034%, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, exploitation is straightforward for any authenticated user, requiring only a simple HTTP request parameter modification with no special tooling (GitHub Advisory, Feedly).

1. Authenticate: Log in to a Chamilo LMS instance as any user enrolled in a course (student-level access is sufficient).
2. Identify target user ID: Enumerate other enrolled users' numeric IDs through course participant lists, profile pages, or other accessible endpoints within the LMS.
3. Intercept a Learning Path save request: Using a browser proxy tool (e.g., Burp Suite), navigate to a Learning Path within the course and trigger a progress save action to capture the outgoing AJAX request to lp_ajax_save_item.php.
4. Modify the uid parameter: In the intercepted request, change the uid parameter value from your own user ID to the target victim's user ID.
5. Manipulate progress data: Adjust other parameters such as s (score), status, and time fields to the desired values, then forward the modified request.
6. Verify impact: The victim's Learning Path progress — including score, completion status, and time — is now overwritten in the database with the attacker-supplied values (GitHub Advisory).

• Network: Repeated POST requests to lp_ajax_save_item.php from a single user session containing uid values that differ from the authenticated user's own ID; multiple rapid requests with varying uid values suggesting enumeration.
• Logs: Web server access logs showing requests to /main/lp/lp_ajax_save_item.php (or /public/main/lp/lp_ajax_save_item.php for 2.x) with uid parameters inconsistent with the session user; unusual patterns of Learning Path save events outside normal course activity hours.
• Database: Unexpected changes to Learning Path progress records (lp_item_view, lp_view tables) for users who have not recently accessed the course; score or completion status changes that do not align with actual course activity logs.

Upgrade Chamilo LMS to version 1.11.38 (for the 1.x branch) or 2.0.0-RC.3 (for the 2.x branch), which fix the vulnerability by replacing $_REQUEST['uid'] with api_get_user_id() in lp_ajax_save_item.php, ensuring the authenticated user's session ID is always used. As an interim workaround for those unable to patch immediately, restrict access to lp_ajax_save_item.php at the web server level to reduce exposure, though this may impact Learning Path functionality. Additionally, review Learning Path progress records for unauthorized modifications that may have occurred during the vulnerability window (GitHub Advisory, Patch Commit 1, Patch Commit 2).