Live › vulnerability › CVE-2026-45141
Chamilo LMS before 2.0.1 performs several skill and profile database changes without checking a CSRF token. A malicious web page can make a logged-in administrator or DRH user create, modify or delete skill records and profiles.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 15:31 UTC. All times on this page are UTC.
Any Chamilo LMS install below 2.0.1 is exposed. The risk requires an administrator or DRH user with an active session to visit an attacker-controlled page, so installs where admins rarely browse the web are less exposed. Teams running Chamilo for training should check their version.
No product ranges from the sources yet.
2.0.1public/main/inc/ajax/skill.ajax.php in the install and confirm whether the add, delete_gradebook_from_skill, save_profile and delete_profile actions call Security::check_token()2.0.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, the add, delete_gradebook_from_skill, save_profile, and delete_profile actions in public/main/inc/ajax/skill.ajax.php perform database mutations without Security::check_token() validation. An attacker can use cross-site request forgery to cause an authenticated administrator or DRH who visits a malicious page to create, modify, or delete skill records and profiles, or remove skill-gradebook associations. This issue is fixed in version 2.0.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-45141")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.