{"id":"CVE-2026-114390","kind":"vulnerability","aliases":["CVE-2026-114390"],"related":[],"title":"Chamilo LMS: missing authorization lets users harvest names and certificates","description":"Chamilo LMS from 2.0.0-alpha.1 before 2.0.0-RC.3 contains a missing authorization vulnerability in legacy AJAX handlers under public/main/inc/ajax/ that exposes user names and certificates. Unauthenticated or low-privileged users can call actions like get_users_by_group_course, user_by_all_roles, and export_all_certificates to harvest user names and other learners' certificate PDFs.","summary":"Chamilo LMS versions from 2.0.0-alpha.1 before 2.0.0-RC.3 expose several legacy AJAX handlers without authorization checks. An unauthenticated or low-privileged user can list learner names and download other learners' certificate PDFs.","severity":"medium","cvss":6.9,"epss":0.00227,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["chamilo","lms","package","php","self-hosted"],"not_affected_if":["managed-hosting","patched-version"],"how_to_check":"- Check the installed Chamilo version in the admin footer or `composer.json`; affected if it is `2.0.0-alpha.1` up to but not including `2.0.0-RC.3`\n- Look for `public/main/inc/ajax/` handlers such as `get_users_by_group_course`, `user_by_all_roles` and `export_all_certificates` in the deployed code","fix":"- Upgrade Chamilo LMS to `2.0.0-RC.3` or later\n- Until upgraded, restrict access to `public/main/inc/ajax/` at the web server to logged-in staff only","status":"open","published_at":"2026-10-21T13:18:29+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:39:04+00:00","updated_at":"2026-10-25T03:39:04+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:39:04Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Chamilo LMS to `2.0.0-RC.3` or later\n- Until upgraded, restrict access to `public/main/inc/ajax/` at the web server to logged-in staff only","reach":"internet","title":"Chamilo LMS: missing authorization lets users harvest names and certificates","impact":"medium","summary":"Chamilo LMS versions from 2.0.0-alpha.1 before 2.0.0-RC.3 expose several legacy AJAX handlers without authorization checks. An unauthenticated or low-privileged user can list learner names and download other learners' certificate PDFs.","category":"package","nicknames":[],"who_cares":["chamilo","lms","self-hosted","php"],"confidence":0.7,"needs_auth":"unknown","worst_case":"learner names and other learners' certificate PDFs readable","analyst_note":"Confirm from the NVD entry or the Chamilo advisory whether the affected handlers require any login on default configuration, and whether a fixed-version commit or advisory exists.","how_to_check":"- Check the installed Chamilo version in the admin footer or `composer.json`; affected if it is `2.0.0-alpha.1` up to but not including `2.0.0-RC.3`\n- Look for `public/main/inc/ajax/` handlers such as `get_users_by_group_course`, `user_by_all_roles` and `export_all_certificates` in the deployed code","needs_analyst":true,"not_affected_if":["managed-hosting","patched-version"],"who_is_affected":"Self-hosted Chamilo LMS installations in the 2.0.0-alpha.1 to 2.0.0-RC.2 range are exposed, since the flawed handlers are reachable through the web application. Installations on older or newer releases, or hosted by a vendor that has already patched, can skip it. The sources do not say whether the handlers are reachable without a login on default configuration.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000688,"input_tokens":3425,"output_tokens":691,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114390':13A,16A '-2026':12A,15A '2.0.0':28B,31B,61C,64C 'action':91C 'ajax':36B,73C 'alpha.1':29B,62C 'author':4A,39B,69C 'call':90C 'certif':10A,56B,82C,105C,113C 'chamilo':1A,17B,24B,58C 'check':40B 'contain':66C 'cours':97C 'cve':11A,14A 'download':53B 'export':103C 'expos':33B,78C 'get':93C 'group':96C 'handler':37B,74C 'harvest':7A,107C 'host':23B 'learner':50B,55B,112C 'legaci':35B,72C 'let':5A 'like':92C 'list':49B 'lms':2A,18B,25B,59C 'low':45B,86C 'low-privileg':44B,85C 'miss':3A,68C 'name':8A,51B,80C,109C 'packag':19B 'pdfs':57B,114C 'php':20B 'privileg':46B,87C 'public/main/inc/ajax':76C 'rc.3':32B,65C 'role':101C 'self':22B 'self-host':21B 'sever':34B 'unauthent':42B,83C 'user':6A,47B,79C,88C,94C,98C,108C 'version':26B 'vulner':70C 'without':38B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Chamilo LMS installations in the 2.0.0-alpha.1 to 2.0.0-RC.2 range are exposed, since the flawed handlers are reachable through the web application. Installations on older or newer releases, or hosted by a vendor that has already patched, can skip it. The sources do not say whether the handlers are reachable without a login on default configuration.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T13:18:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114390","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114390","severity":null,"published_at":"2026-10-21T13:18:29+00:00","modified_at":"2026-10-22T17:40:46+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114390","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114390","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}