CVE-2026-34602: 
Chamilo vulnerability analysis and mitigation

CVE-2026-34602 is an Insecure Direct Object Reference (IDOR) / Broken Object Level Authorization (BOLA) vulnerability in Chamilo LMS affecting the /api/course_rel_users API endpoint. It allows an authenticated attacker with low privileges to enroll any arbitrary user into any course by manipulating the user parameter in the request body, bypassing all authorization checks. Affected versions include all 1.x releases through 1.11.38, and 2.0.0-alpha1 through 2.0.0-RC.2; the issue is fixed in version 2.0.0-RC.3. It carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory).

The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key). The vulnerable POST /api/course_rel_users endpoint accepts a JSON payload containing a user field (e.g., "/api/users/{user_id}"), and the backend blindly trusts this user-supplied value without verifying that the authenticated requester owns the referenced user_id or has permission to act on behalf of that user. The fix introduced a CourseRelUserStateProcessor class that enforces securityPostDenormalize: 'object.getUser() == user', ensuring the enrolled user matches the authenticated session, and additionally validates that the target course is available in the public catalogue for non-admin users (GitHub Advisory, Patch Commit).

An authenticated attacker can exploit this vulnerability to enroll any platform user into any course without authorization, granting unintended access to course materials and bypassing enrollment controls. This compromises platform integrity and may expose sensitive educational content to unauthorized parties. While availability is unaffected and there is no direct remote code execution, the high integrity impact stems from the ability to manipulate user-course relationships across the entire platform, potentially affecting all users and administrators (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability requires only a low-privilege authenticated account and no user interaction, making it relatively easy to exploit once access is obtained. The EPSS score is approximately 0.028% (0.000280), indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Obtain authenticated access: Register or obtain credentials for any low-privilege user account on the target Chamilo LMS instance (versions ≤ 1.11.38 or 2.0.0-alpha1 through 2.0.0-RC.2).
2. Identify target user and course IDs: Browse the platform or query available API endpoints to enumerate valid user IDs (e.g., /api/users) and course IDs (e.g., /api/courses) accessible to the authenticated session.
3. Craft malicious POST request: Send a POST request to /api/course_rel_users with a JSON body substituting the victim's user ID:

{
  "user": "/api/users/{victim_user_id}",
  "course": "/api/courses/{target_course_id}",
  "relationType": 0,
  "status": 5
}

4. Confirm unauthorized enrollment: Verify the response contains the victim user's details (e.g., "username": "jbaker") confirming the backend processed the attacker-controlled user reference without authorization checks.
5. Achieve objective: The victim user is now enrolled in the target course, gaining access to its materials, or the attacker can repeat the process to manipulate enrollment records across the platform (GitHub Advisory).

• Network: Unusual POST requests to /api/course_rel_users from authenticated users where the user field in the JSON body references a user ID different from the authenticated session's user ID; high volume of enrollment API calls from a single account in a short timeframe.
• Logs: API access logs showing repeated POST requests to /api/course_rel_users with varying user IDs from the same authenticated session; response bodies containing usernames or full names not matching the requesting user.
• Application Data: Unexpected or unexplained course enrollments for users who did not self-enroll and were not enrolled by an administrator; enrollment timestamps inconsistent with normal administrative activity.
• Process/Behavior: A single low-privilege account generating enrollment records for multiple distinct users across multiple courses in a short period (GitHub Advisory).

The primary remediation is to upgrade Chamilo LMS to version 2.0.0-RC.3 or later, which introduces the CourseRelUserStateProcessor with proper post-denormalization authorization checks (RC.3 Release). For organizations unable to upgrade immediately, implement network-level access controls to restrict access to the /api/course_rel_users endpoint to trusted systems only, and audit all course enrollment logs for unauthorized changes. Additionally, review and verify all existing user-course relationships in the system for anomalies that may indicate prior exploitation.