Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the /api/course_rel_users endpoint is vulnerable to Insecure Direct Object Reference (IDOR), allowing an authenticated attacker to modify the user parameter in the request body to enroll any arbitrary user into any course without proper authorization checks. The backend trusts the user-supplied input for the user field and performs no server-side verification that the requester owns the referenced user ID or has permission to act on behalf of other users. This enables unauthorized manipulation of user-course relationships, potentially granting unintended access to course materials, bypassing enrollment controls, and compromising platform integrity. This issue has been fixed in version 2.0.0-RC.3.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-34602 Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the /api/course_rel_users endpoint is vulnerable to Insecure Direct Object … https://www.cve.org/CVERecord?id=CVE-2026-34602
Post summary
The text announces CVE-2026-34602 in Chamilo LMS, giving the vulnerable endpoint and type (Insecure Direct Object), but provides no PoC, exploit, or patch information.
CVE-2026-34602 Insecure Direct Object Reference in Chamilo LMS Prior to 2.0.0-RC.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-34602
Post summary
The snippet references CVE-2026-34602 and describes it as an insecure direct object reference affecting Chamilo LMS versions before 2.0.0-RC.3, but it lacks details on PoC, exploitation, or mitigation.
11 of 11 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | chamilo | chamilo_lms | - | - | - |
| App | chamilo | chamilo_lms | 2.0.0 | - | - |
| App | chamilo | chamilo_lms | 2.0.0 | - | - |
| App | chamilo | chamilo_lms | 2.0.0 | - | - |
| App | chamilo | chamilo_lms | 2.0.0 | - | - |
| App | chamilo | chamilo_lms | 2.0.0 | - | - |
| App | chamilo | chamilo_lms | 2.0.0 | - | - |
| App | chamilo | chamilo_lms | 2.0.0 | - | - |
| App | chamilo | chamilo_lms | 2.0.0 | - | - |
| App | chamilo | chamilo_lms | 2.0.0 | - | - |
| App | chamilo | chamilo_lms | 2.0.0 | - | - |