Live › vulnerability › CVE-2026-114390
Go to dashboardChamilo LMS versions from 2.0.0-alpha.1 before 2.0.0-RC.3 expose several legacy AJAX handlers without authorization checks. An unauthenticated or low-privileged user can list learner names and download other learners' certificate PDFs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted Chamilo LMS installations in the 2.0.0-alpha.1 to 2.0.0-RC.2 range are exposed, since the flawed handlers are reachable through the web application. Installations on older or newer releases, or hosted by a vendor that has already patched, can skip it. The sources do not say whether the handlers are reachable without a login on default configuration.
No product ranges from the sources yet.
composer.json; affected if it is 2.0.0-alpha.1 up to but not including 2.0.0-RC.3public/main/inc/ajax/ handlers such as get_users_by_group_course, user_by_all_roles and export_all_certificates in the deployed code2.0.0-RC.3 or laterpublic/main/inc/ajax/ at the web server to logged-in staff onlyEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Chamilo LMS from 2.0.0-alpha.1 before 2.0.0-RC.3 contains a missing authorization vulnerability in legacy AJAX handlers under public/main/inc/ajax/ that exposes user names and certificates. Unauthenticated or low-privileged users can call actions like get_users_by_group_course, user_by_all_roles, and export_all_certificates to harvest user names and other learners' certificate PDFs.
This page as .md · .json · in your agent: get_signal("CVE-2026-114390")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.