EUVD-2026-113996 reports anonymous access to user profile data in Chamilo LMS
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Chamilo
- Product
- chamilo-lms
- First seen
Summary
The EUVD advisory states that from Chamilo LMS 2.0.0 until 2.0.1, the GET /user/{username} endpoint is reachable without authentication and renders six user-editable profile fields. The item is truncated, so the full impact is not stated.
If you use Chamilo
Upgrade Chamilo LMS to 2.0.1 or later
Review web server logs for requests to /user/ endpoints
Limit public exposure of the LMS until patched
Restrict access to CSV import functionality
Back up the database before upgrading
Review skill and profile records for unexpected changes
What the sources say 4
· Mastodon: “multiple `eval()` calls in the vendored PEAR `HTML_QuickForm` libraries can execute arbitrary PHP code” Source
· Mastodon: “Prior to 2.0.1, the `add`, `delete_gradebook_from_skill`, `save_profile`, and `delete_profile` actions in `public/main/inc/ajax/skill.ajax.php` perform database mutations without” Source
· Mastodon: “Prior to 2.0.1, `public/main/inc/lib/career.lib.php` and `public/main/cron/import_csv.php` call PHP's native `unserialize()` on `user_career.extra_data`” Source
· Mastodon: “From 2.0.0 until 2.0.1, `GET /user/{username}` is anonymously reachable and renders six user-editable profile fields (`firstname`, `lastname`, `competences`, `openarea`, `teach`, and `diplomas`)” Source