CVE-2026-40291: 
Chamilo vulnerability analysis and mitigation

CVE-2026-40291 is a privilege escalation vulnerability in Chamilo LMS caused by an insecure direct object modification flaw in the PUT /api/users/{id} API endpoint. Any authenticated user with ROLE_STUDENT can escalate their privileges to ROLE_ADMIN by modifying the roles field on their own user record. Affected versions include all Chamilo LMS releases up to and including 1.11.38, and all 2.0.0 pre-release versions (alpha1–alpha5, beta1–beta3, RC1–RC2); the issue is fixed in version 2.0.0-RC.3. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-269 (Improper Privilege Management) and CWE-863 (Incorrect Authorization). The vulnerable User entity in src/CoreBundle/Entity/User.php configures the API Platform PUT operation with the security expression is_granted('EDIT', object), which only verifies that the requesting user owns the record — it does not restrict which fields can be modified. Because the roles field is included in the writable serialization group, any authenticated student can send a crafted PUT request to /api/users/{id} with a body containing "roles": ["ROLE_ADMIN"], immediately granting themselves full administrative privileges. No special tools or elevated access are required beyond a valid student account (GitHub Advisory).

Successful exploitation grants the attacker full administrative control of the Chamilo LMS platform, including unrestricted access to all courses, user data, grades, and administrative settings. The advisory notes that when combined with a separate RCE vulnerability (Advisory 2 / CVE-2026-35196), this privilege escalation can serve as a stepping stone to Remote Code Execution on the underlying server. Any registered student account is sufficient to trigger the escalation, making the effective attack surface the entire student user base of any vulnerable Chamilo instance (GitHub Advisory, Feedly).

There is currently no public proof-of-concept exploit code and no confirmed evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.039%, reflecting low but non-zero probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the time of this report. No specific threat actor attribution has been made. The low attack complexity and requirement of only a low-privilege authenticated account make this straightforward to exploit if an attacker has any student-level access.

1. Obtain a student account: Register or obtain credentials for any ROLE_STUDENT account on the target Chamilo LMS instance (versions prior to 2.0.0-RC.3).
2. Authenticate and retrieve a session token: Log in via the Chamilo API or web interface to obtain a valid authentication token (e.g., JWT or session cookie).
3. Identify the user's own ID: Query the API (e.g., GET /api/users/me or inspect the authenticated session) to retrieve the authenticated user's numeric ID.
4. Craft the privilege escalation request: Send a PUT request to /api/users/{id} with the Content-Type: application/ld+json header and a JSON body containing {"roles": ["ROLE_ADMIN"]}, using the student's own user ID.
5. Confirm privilege escalation: Verify the response confirms the role update, then access administrative endpoints (e.g., /api/users to list all users, or the admin dashboard) to confirm ROLE_ADMIN access has been granted.
6. Leverage admin access: With full administrative control, exfiltrate user data, grades, and course content, modify platform settings, or chain with CVE-2026-35196 for Remote Code Execution (GitHub Advisory).

• Network: Unexpected PUT requests to /api/users/{id} from student-level accounts, particularly with JSON bodies containing "roles": ["ROLE_ADMIN"] or other elevated role strings; unusual API activity from accounts that do not normally use the REST API.
• Logs: Application or API access logs showing a PUT /api/users/{id} request followed immediately by administrative API calls (e.g., GET /api/users, DELETE /api/users/{id}) from the same session or IP; authentication logs showing a student account suddenly accessing admin-only routes.
• Application Behavior: Student accounts appearing in the admin user list with ROLE_ADMIN assigned; unexpected changes to platform settings, course enrollments, or user records not initiated by known administrators.
• Audit Trail: Missing or altered grade records, newly created admin accounts, or bulk data exports initiated by accounts that were previously student-level (GitHub Advisory).

The primary remediation is to upgrade Chamilo LMS to version 2.0.0-RC.3 or later, which restricts the roles field from being modified via the PUT /api/users/{id} endpoint by non-administrative users (GitHub Release). For organizations unable to patch immediately, the following interim mitigations are recommended:

• Implement network-level access controls (e.g., WAF rules or reverse proxy filters) to block or restrict PUT requests to /api/users/{id} from non-administrative sessions.
• Disable the API Platform REST API entirely until the upgrade can be completed.
• Review audit logs for any unauthorized role changes and reset affected accounts.
• Monitor for student accounts with ROLE_ADMIN assigned and revoke elevated privileges immediately (Feedly).

The vulnerability was reported by security researcher 8l4nnk and disclosed via GitHub Security Advisories on April 10, 2026 (GitHub Advisory). The Hacker Wire published a write-up covering the IDOR-to-admin-privilege chain (The Hacker Wire), and the issue was also noted by INCIBE-CERT in Spain. Social media discussion was limited, with a Mastodon post from The Hacker Wire and a Bluesky mention from CyberHub. Community attention has been moderate, with the vulnerability noted alongside a related RCE issue (CVE-2026-35196) affecting the same platform.