CVE-2026-33708: 
Chamilo vulnerability analysis and mitigation

CVE-2026-33708 is a missing authorization vulnerability in Chamilo LMS affecting the get_user_info_from_username REST API endpoint. Any authenticated user — including low-privileged students — can query this endpoint to retrieve personally identifiable information (PII) such as email addresses, first and last names, user IDs, and account status for any user in the system. All versions prior to 1.11.38 are affected. The vulnerability was published on April 10, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Feedly).

The root cause is CWE-862 (Missing Authorization): the GET_USER_INFO_FROM_USERNAME case in main/webservices/api/v2.php (lines 583–614) calls api_get_user_info_from_username() and returns full user PII without invoking any role-verification function such as api_is_platform_admin() or protectAdminEndpoint(). An attacker with any valid session token can send an authenticated POST request to the REST API endpoint with a target loginname parameter and receive the victim's email, full name, user ID, username, and active status in the response. The fix, applied in commit 4a119f9, adds a check for api_is_platform_admin() at the top of the case block, throwing a NotAllowed exception for non-admin callers (GitHub Advisory, GitHub Commit).

Any authenticated user can systematically enumerate the entire user directory by iterating over known or guessed usernames, harvesting email addresses and real names at scale. This enables targeted phishing and social engineering campaigns against the platform's user base. More critically, the advisory documents a verified attack chain where this vulnerability is combined with other Chamilo flaws: an attacker can use the exposed email address to compute sha1(email) and trigger a password reset, leading to full account takeover — including administrator accounts — without initially holding elevated privileges (GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.028%, reflecting a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, exploitation requires only a valid low-privilege account and a simple authenticated API call, making it trivially easy to abuse if credentials are available.

1. Obtain valid credentials: Register or obtain any low-privilege account (e.g., a student account) on the target Chamilo LMS instance running a version prior to 1.11.38.
2. Authenticate to the REST API: Send a login request to the Chamilo REST API to obtain a valid session token or API key.
3. Query the vulnerable endpoint: Send an authenticated POST request to the REST API endpoint (e.g., /main/webservices/rest.php or the v2 API path) with the action GET_USER_INFO_FROM_USERNAME and a loginname parameter set to the target username.
4. Harvest PII: Parse the JSON response to extract the target user's email address, first name, last name, user ID, and active status.
5. Enumerate users at scale: Iterate over common or guessed usernames (e.g., admin, teacher1, student email prefixes) to build a full directory of users and their PII.
6. Chain for account takeover (optional): Use the harvested admin email address in conjunction with the Chamilo password reset mechanism (computing sha1(email) as the reset token, per related advisory chain) to reset the admin password and achieve full platform compromise (GitHub Advisory).

• Network: Repeated authenticated POST requests to the Chamilo REST API endpoint (/main/webservices/api/v2.php or equivalent) with the action parameter GET_USER_INFO_FROM_USERNAME from a single low-privilege user account in a short time window.
• Logs: Web server access logs showing high-frequency API calls to the webservices endpoint from a single IP or session, cycling through different loginname values; application logs showing bulk user info lookups by non-admin accounts.
• Behavioral: A student or low-privilege account making an unusually large number of API requests compared to normal usage patterns; subsequent password reset requests for accounts whose emails were recently queried via the API.

Upgrade Chamilo LMS to version 1.11.38 or later, which restricts the GET_USER_INFO_FROM_USERNAME REST API action to platform administrators only (GitHub Commit, GitHub Advisory). If immediate patching is not feasible, implement network-level controls (e.g., WAF rules or firewall policies) to restrict access to the REST API endpoint, or disable the GET_USER_INFO_FROM_USERNAME action if it is not required for business operations. Additionally, audit REST API access logs to identify any unauthorized enumeration activity that may have already occurred.

The advisory was published by Chamilo maintainer ywarnier on GitHub on April 10, 2026, and credited researcher 8l4nnk for the report (GitHub Advisory). The advisory explicitly documents multi-step attack chains combining this vulnerability with other Chamilo flaws, indicating coordinated responsible disclosure of a broader set of issues. No significant broader media coverage or notable social media commentary has been identified beyond standard vulnerability database aggregation.