Authorization bypass through user-controlled key in Chamilo LMS - CVE-2026-61734
Published: August 4, 2026
Vulnerability details
The vulnerability allows a remote user to read other users' Web Push secrets, hijack Web Push notifications, and delete push subscriptions to cause a denial of service.
The vulnerability exists due to improper authorization and improperly controlled modification of dynamically-determined object attributes in the /api/push_subscriptions endpoint when handling authenticated API requests. A remote user can supply another user's identifier in the request body or access another user's subscription object to read sensitive fields, re-route notifications to an attacker-controlled endpoint, or delete another user's subscription to read other users' Web Push secrets, hijack Web Push notifications, and delete push subscriptions to cause a denial of service.
Exploitation can expose cryptographic Web Push material including endpoint, publicKey, and authToken, and can affect private messages, MFA codes, password-reset links, and course announcements delivered through the Web Push feature.