{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-33702/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-33702"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["chamilo","lms","idor","cve-2026-33702"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eChamilo LMS, a widely used learning management system, is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability affecting versions prior to 1.11.38 and 2.0.0-RC.3. This flaw resides in the \u003ccode\u003elp_ajax_save_item.php\u003c/code\u003e endpoint, which handles saving Learning Path progress. The vulnerability allows any authenticated user enrolled in a course to manipulate the learning path progress of other users, including scores, status, completion, and time spent. This is achieved by directly modifying the \u003ccode\u003euid\u003c/code\u003e parameter in the HTTP request, which specifies the target user ID, without proper authorization checks. Successful exploitation could lead to unauthorized modification of student records and potentially impact grading and certification processes. It is critical to upgrade to the patched versions to mitigate this risk.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker authenticates to the Chamilo LMS platform with a valid user account.\u003c/li\u003e\n\u003cli\u003eThe attacker enrolls in a course containing a Learning Path.\u003c/li\u003e\n\u003cli\u003eThe attacker identifies the target user's ID within the course (e.g., from the user list or course roster).\u003c/li\u003e\n\u003cli\u003eThe attacker initiates an action that triggers a request to \u003ccode\u003elp_ajax_save_item.php\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker intercepts the HTTP request (e.g., using browser developer tools or a proxy).\u003c/li\u003e\n\u003cli\u003eThe attacker modifies the \u003ccode\u003euid\u003c/code\u003e parameter in the request to the target user's ID.\u003c/li\u003e\n\u003cli\u003eThe attacker modifies other parameters related to learning path progress such as score, status, completion, or time.\u003c/li\u003e\n\u003cli\u003eThe attacker submits the modified request to \u003ccode\u003elp_ajax_save_item.php\u003c/code\u003e, resulting in the target user's learning path progress being altered.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this IDOR vulnerability allows an attacker to arbitrarily modify the learning path progress of other users within Chamilo LMS. This could lead to students receiving credit for work they did not complete or having their progress unfairly reset. This could affect the integrity of the course grading system and lead to inaccurate certifications or diplomas being awarded. This can undermine trust in the educational institution and the value of its credentials.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Chamilo LMS to version 1.11.38 or 2.0.0-RC.3 to patch CVE-2026-33702.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule to monitor for suspicious requests to \u003ccode\u003elp_ajax_save_item.php\u003c/code\u003e with modified \u003ccode\u003euid\u003c/code\u003e parameters.\u003c/li\u003e\n\u003cli\u003eImplement stricter access controls and input validation for user ID parameters in all API endpoints.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-04-11T12:00:00Z","date_published":"2026-04-11T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2026-04-11-chamilo-idor/","summary":"Chamilo LMS before versions 1.11.38 and 2.0.0-RC.3 is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability, allowing authenticated users to modify the learning path progress of other users by manipulating the 'uid' parameter in the lp_ajax_save_item.php endpoint.","title":"Chamilo LMS IDOR Vulnerability Allows Learning Path Manipulation","url":"https://feed.craftedsignal.io/briefs/2026-04-11-chamilo-idor/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-33702","version":"https://jsonfeed.org/version/1.1"}