CVE-2026-33703: 
Chamilo vulnerability analysis and mitigation

CVE-2026-33703 is a critical Insecure Direct Object Reference (IDOR) / Broken Object Level Authorization (BOLA) vulnerability in Chamilo LMS affecting the /social-network/personal-data/{userId} endpoint. It allows any authenticated user to access the full personal data and API tokens of arbitrary users by manipulating the userId parameter, enabling mass platform data breach. Affected versions include all 2.0.0 pre-releases up to and including 2.0.0-RC.2 (alpha1 through alpha5, beta1 through beta3, RC1, RC2); the vulnerability is fixed in 2.0.0-RC.3. It carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 7.1 (High) (GitHub Advisory, Feedly). The advisory was published on April 10, 2026, by researcher Aastha2602 (GitHub Advisory).

The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the SocialController endpoint /social-network/personal-data/{userId} is protected only by a class-level #[IsGranted('ROLE_USER')] annotation, meaning any authenticated user passes the role check. The controller method getPersonalData(int $userId, ...) directly passes the attacker-supplied userId to $userToJsonNormalizer->serializeUserData($userId) without verifying that the requester owns the requested data or holds administrative privileges — a textbook BOLA flaw (GitHub Advisory). Sensitive fields returned include username, email, phone number, physical address, gender, locale, timezone, biography, last login timestamp, roles (including admin identification), and the user's ApiToken credential. The attack requires only a valid low-privileged account and network access, with no rate limiting or monitoring in place, making automated mass enumeration trivial (GitHub Advisory).

Successful exploitation enables any authenticated user to extract complete personal profiles and API credentials for every user on the platform, including administrators, resulting in mass PII disclosure and credential leakage. Stolen API tokens can be used to impersonate users, escalate privileges, or perform unauthorized actions across the platform, effectively enabling a full platform data breach. The integrity impact is rated HIGH, as compromised credentials facilitate account takeover and potential modification of user data; all users — including privileged accounts — are at risk (GitHub Advisory, Feedly).

As of the time of publication, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.038%, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack is easily automatable — requiring only a valid user account and sequential iteration of userId values — making it a high-risk candidate for rapid weaponization in multi-user educational environments (GitHub Advisory).

1. Obtain a low-privileged account: Register or obtain any valid user account on the target Chamilo LMS instance (version ≤ 2.0.0-RC.2).
2. Authenticate: Log in to the platform and capture a valid session token or cookie via the standard login flow.
3. Enumerate userId values: Send authenticated HTTP GET requests to /social-network/personal-data/{userId}, iterating integer userId values starting from 1 (e.g., using a script or tool like curl or Burp Suite Intruder).
4. Extract sensitive data: For each valid userId, the API returns a JSON response containing the target user's username, email, phone, address, roles, and ApiToken credential — no additional authorization is required.
5. Mass harvest: Automate iteration across all user IDs to bulk-extract PII and API tokens for the entire user base in seconds.
6. Leverage stolen credentials: Use harvested API tokens to authenticate as other users (including admins), enabling account takeover, privilege escalation, or further platform compromise (GitHub Advisory).

• Network: High volume of authenticated GET requests to /social-network/personal-data/ with sequentially or randomly varying userId path parameters from a single source IP or user session.
• Logs: Web server or application access logs showing repeated requests to the /social-network/personal-data/{userId} endpoint across many different user IDs within a short time window from the same authenticated session.
• Logs: Unusual access patterns where a single low-privileged user account queries personal data endpoints for user IDs other than their own.
• Application: API token usage from unexpected IP addresses or user agents, suggesting stolen tokens are being leveraged for impersonation after extraction.

Upgrade Chamilo LMS to version 2.0.0-RC.3 or later, which introduces proper ownership and authorization checks on the /social-network/personal-data/{userId} endpoint (GitHub Advisory). For organizations unable to patch immediately, implement network-level access controls (e.g., WAF rules or reverse proxy restrictions) to block or rate-limit access to the /social-network/personal-data/ endpoint path. Consider disabling social network features if not operationally required, and audit application logs for suspicious sequential access patterns to the affected endpoint. After patching, rotate all API tokens for platform users, particularly administrator accounts, as tokens may have already been exposed.

The vulnerability was reported by researcher Aastha2602 and published via GitHub Security Advisories on April 10, 2026 (GitHub Advisory). The advisory was assigned a "Critical" severity label by the Chamilo maintainers despite the CVSS v3.1 score of 6.5, reflecting the practical severity of mass credential exposure. No significant broader media coverage or notable social media commentary has been identified at this time.