Cross-site request forgery in Chamilo LMS - CVE-2026-81877
Published: November 9, 2026
Vulnerability identifier: #VU163206
CSH Severity: Medium
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-81877
CWE-ID: CWE-352
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to make unauthorized changes to course and user data in Chamilo LMS.
The vulnerability exists due to missing CSRF token validation in multiple administrative endpoints when processing state-changing POST requests. An unauthenticated remote attacker can trick an authenticated administrator into visiting a malicious web page that submits forged requests with the victim's privileges, causing bulk deletions or unauthorized course assignments.
Affected software
Chamilo LMS
How to mitigate CVE-2026-81877
Install security update from vendor's website.
Chamilo LMS - addressed in versions 1.11.40, 2.0.3