CVE-2026-33706: 
Chamilo vulnerability analysis and mitigation

CVE-2026-33706 is a privilege escalation vulnerability in Chamilo LMS affecting all versions prior to 1.11.38. Any authenticated user holding a REST API key can modify their own status field via the update_user_from_username endpoint, allowing a student (status=5) to self-promote to Teacher/CourseManager (status=1) without administrative approval. The vulnerability was published on April 10, 2026, and fixed in version 1.11.38. It carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory).

The root cause is improper privilege management (CWE-269) in main/inc/lib/webservices/Rest.php within the updateUserFromUserName() method. The authorization check at line 2710 only verifies that a user is modifying their own account ($userId != $this->user->getId()), but does not restrict which fields can be modified — allowing sensitive fields like status, roles, auth_source, active, and enabled to be set to arbitrary values. An attacker with a valid REST API key can send a crafted API request setting status=1 to gain Teacher/CourseManager privileges. The developers had even noted this risk with a @todo make a safe version for use by the final user on its account comment at line 2688, indicating the issue was known but unaddressed (GitHub Advisory, Patch Commit).

Successful exploitation allows a student to gain Teacher or CourseManager privileges, enabling unauthorized course creation, course content management, grade modification, and access to sensitive course materials. Beyond role escalation, the same endpoint can be abused to modify over 25 additional sensitive fields including roles, auth_source, active, and enabled, further undermining the platform's trust model. The primary impact is high integrity loss and low confidentiality loss, with no direct availability impact (GitHub Advisory).

As of the time of publication, there is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.025% (0.000250), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to already be an authenticated user with a REST API key, which limits the attack surface to registered platform users.

1. Obtain a REST API key: Log in to the Chamilo LMS instance as a student account and generate or retrieve a personal REST API key from the user profile or API settings.
2. Identify the vulnerable endpoint: Locate the update_user_from_username REST API endpoint, typically accessible at the platform's REST API base URL (e.g., /main/webservices/rest.php).
3. Craft a privilege escalation request: Send an authenticated API request to the update_user_from_username endpoint with the status parameter set to 1 (Teacher/CourseManager), targeting the attacker's own username.
4. Confirm privilege escalation: Log in to the Chamilo web interface and verify that the account now has Teacher/CourseManager privileges, including access to course creation and management features.
5. Abuse elevated privileges: Create courses, modify grades, access restricted course materials, or further manipulate other user accounts within the scope of the newly acquired role (GitHub Advisory).

• Network: Unusual REST API calls to /main/webservices/rest.php with the update_user_from_username action and a status parameter set to 1 from non-administrative user accounts.
• Logs: Application or web server access logs showing POST requests to the REST API endpoint with status=1 or other admin-only field modifications by student-level accounts; repeated API calls from the same user in a short timeframe.
• Application: Unexpected changes in user role assignments visible in the Chamilo admin panel — specifically students appearing with Teacher or CourseManager status without administrative action.
• Audit: Newly created courses or modified grades attributed to accounts that were previously student-level users.

Upgrade Chamilo LMS to version 1.11.38 or later, which restricts non-admin users from modifying admin-only fields (status, roles, auth_source, enabled, active, creator_id, registration_date, expiration_date, hr_dept_id, official_code) in the REST API (Patch Commit). For systems that cannot be patched immediately, restrict REST API key issuance to trusted administrators only and implement network-level controls to limit access to the REST API endpoint. Additionally, audit existing user role assignments to identify any unauthorized privilege escalations that may have already occurred.