Missing Authorization in Chamilo LMS - CVE-2026-61531
Published: August 4, 2026
Vulnerability identifier: #VU140929
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-61531
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to modify blog content and disclose sensitive information.
The vulnerability exists due to missing authorization in the blog API endpoints when handling requests for blog and blog post resources. A remote user can send crafted API requests targeting blogs or posts outside their own course or session scope to modify blog content and disclose sensitive information.
The issue can be exploited across course or session boundaries against blogs owned by users who are not in the attacker's course or session.
Affected software
Chamilo LMS
How to mitigate CVE-2026-61531
Install security update from vendor's website.
Chamilo LMS - update to 2.0.3