CVE-2026-34370Disclosure(chamilo / chamilo_lms)

LOWCVSS 6.5 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the notebook module contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated student to read the private course notes of any other user on the platform by manipulating the notebook_id parameter in the editnote action. The application fetches the note content using only the supplied integer ID without verifying that the requesting user owns the note, and the full title and HTML body are rendered in the edit form and returned to the attacker's browser. While ownership checks exist in the write paths (updateNote() and delete_note()), they are entirely absent from the read path (get_note_information()). This issue has been fixed in version 2.0.0-RC.3.

chamilo CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-fm35-2hvw-564q

Other references

https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3

Weakness type (CWE)

CWE-285CWE-639

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

chamilo_lms

Threat summary

2 mentions across 1 observed day

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
2 total mentions across 1 day

Affected systems

Vendors

chamilo

Products

chamilo_lms

1 version affected across 1 product

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

CVE@CVEnew176d
Disclosure
CVE-2026-34370 Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the notebook module contains an Insecure Direct Object Reference (IDOR) vul… https://www.cve.org/CVERecord?id=CVE-2026-34370
Post summary
The text announces CVE‑2026‑34370 as an IDOR vulnerability in Chamilo LMS’s notebook module for versions prior to 2.0.0‑RC.3, without providing a proof‑of‑concept, exploit details, or patch information.
0000087
57.2K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds176d
Disclosure
CVE-2026-34370 Insecure Direct Object Reference in Chamilo LMS Notebook Module Prior to 2.0.0-RC.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-34370
Post summary
The post announces CVE-2026-34370, presenting it as an IDR vulnerability in the Chamilo LMS Notebook Module prior to version 2.0.0‑RC.3, with no evidence of exploitation, PoC, patch, or false‑positive claims.
0000039
4.0K followersView on X

CPE platform detail11 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

11 of 11 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	chamilo	chamilo_lms	-	-	-
App	chamilo	chamilo_lms	2.0.0	-	-
App	chamilo	chamilo_lms	2.0.0	-	-
App	chamilo	chamilo_lms	2.0.0	-	-
App	chamilo	chamilo_lms	2.0.0	-	-
App	chamilo	chamilo_lms	2.0.0	-	-
App	chamilo	chamilo_lms	2.0.0	-	-
App	chamilo	chamilo_lms	2.0.0	-	-
App	chamilo	chamilo_lms	2.0.0	-	-
App	chamilo	chamilo_lms	2.0.0	-	-
App	chamilo	chamilo_lms	2.0.0	-	-

Explore more

Back to dashboard chamilo CVEs chamilo_lms vulnerabilities