CVE-2026-34370: 
Chamilo vulnerability analysis and mitigation

CVE-2026-34370 is an Insecure Direct Object Reference (IDOR) vulnerability in the notebook module of Chamilo LMS that allows any authenticated student to read the private course notes of other users by manipulating the notebook_id parameter. It affects all Chamilo LMS versions up to and including 1.11.38, as well as 2.0.0-alpha1 through 2.0.0-RC.2. The vulnerability was published on April 14, 2026, and patched in version 2.0.0-RC.3. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is improper authorization (CWE-285 / CWE-639: Authorization Bypass Through User-Controlled Key) in the get_note_information() function within the notebook module's editnote action. When a user requests to edit a note, the application retrieves note content from the database using only the attacker-supplied integer notebook_id parameter, without verifying that the requesting user is the owner of that note. Critically, ownership checks are correctly implemented in the write paths (updateNote() and delete_note()), but are entirely absent from the read path, creating a read-only IDOR. An attacker with any valid student account can enumerate sequential integer IDs to access the full title and HTML body of any other user's private notes (GitHub Advisory).

Successful exploitation allows any authenticated student to enumerate and read private course notes belonging to other students, instructors, or any platform user — including study notes, exam preparation material, instructor personal notes, and notes containing sensitive personal information. The impact is limited to confidentiality (no integrity or availability impact), but the ease of exploitation at scale — requiring only a low-privilege account and no user interaction — means a single malicious student could systematically harvest private notes across an entire institution (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires a valid authenticated account (low privilege) but no user interaction, making it straightforward to exploit at scale once an attacker has any student-level credentials. The EPSS score is approximately 0.028% (0.000280), indicating a currently low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Obtain a valid account: Register or obtain any authenticated student account on the target Chamilo LMS instance running a version prior to 2.0.0-RC.3.
2. Access the notebook module: Log in and navigate to the notebook module to observe a legitimate editnote request, capturing the URL structure (e.g., index.php?action=editnote&notebook_id=<ID>).
3. Enumerate notebook IDs: Systematically increment or iterate the notebook_id integer parameter in the editnote action request (e.g., using Burp Suite Intruder or a simple script with sequential IDs starting from 1).
4. Harvest private notes: For each valid notebook_id belonging to another user, the application returns the full note title and HTML body in the edit form response — capture and store this content.
5. Identify high-value targets: Review harvested notes for sensitive information such as exam answers, personal data, or instructor materials (GitHub Advisory).

• Network: Unusual volume of HTTP GET/POST requests to the notebook editnote action endpoint (e.g., index.php?action=editnote&notebook_id=<sequential_integers>) from a single authenticated user session in a short time window.
• Logs: Web server access logs showing a single user account making rapid sequential requests to the notebook module with incrementing notebook_id values; requests to editnote for note IDs not owned by the requesting user.
• Application Behavior: A student account accessing the edit form for notes belonging to other users, particularly across multiple courses or user accounts in rapid succession.

The vulnerability is fixed in Chamilo LMS version 2.0.0-RC.3, released April 1, 2026. Organizations should upgrade immediately to 2.0.0-RC.3 or later. The fix involves adding an ownership check to the get_note_information() function matching the pattern already used in updateNote() and delete_note(). If an immediate upgrade is not possible, administrators should consider restricting access to the notebook module or implementing network-level controls to limit student account access until patching can be completed (GitHub Advisory, GitHub Release).

The vulnerability was reported by security researcher abhiabhi2306 and published by Chamilo maintainer ywarnier via GitHub Security Advisories on April 14, 2026. No significant broader media coverage or notable community commentary beyond the advisory itself has been identified at this time (GitHub Advisory).