Incorrect authorization in Chamilo LMS - CVE-2026-40291
Published: April 24, 2026
Vulnerability identifier: #VU127558
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-40291
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to incorrect authorization in the PUT operation of the API Platform User entity when handling PUT requests to /api/users/{id}. A remote user can modify their own roles field to escalate privileges.
The issue affects the writable roles field because the security expression only verifies record ownership.
Affected software
Chamilo LMS
How to mitigate CVE-2026-40291
Install security update from vendor's website.
Chamilo LMS - update to 2.0.0 RC.3