Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:LSummary
CVE-2026-33702 is a high-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability in Chamilo Chamilo Lms. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-33702 is an Insecure Direct Object Reference (IDOR) vulnerability, classified under CWE-639, affecting Chamilo LMS, an open-source learning management system. The issue resides in the lp_ajax_save_item.php endpoint used for saving Learning Path progress. In versions prior to 1.11.38 and 2.0.0-RC.3, the endpoint accepts a uid (user ID) parameter directly from $_REQUEST without verifying that it matches the requesting user, allowing unauthorized modification of another user's Learning Path data, including score, status, completion, and time spent. The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L), indicating high integrity impact with low privileges required.
Any authenticated user enrolled in a course can exploit this vulnerability over the network with low complexity and no user interaction. By simply modifying the uid parameter in a request to lp_ajax_save_item.php, an attacker can overwrite the Learning Path progress of any other user in the same course, potentially disrupting educational tracking, falsifying achievements, or enabling academic fraud.
The vulnerability is addressed in Chamilo LMS versions 1.11.38 and 2.0.0-RC.3 through fixes documented in GitHub commits 6331d051b4468deb5830c01d1e047c5e5cf2c74f and bf3f6c6949b5c882b48a9914baa19910417e4551, as detailed in the security advisory GHSA-3rv7-9fhx-j654. Security practitioners should upgrade to these patched versions to mitigate the risk.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21541
Vulnerability Data
Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains an Insecure Direct Object Reference (IDOR) vulnerability in the Learning Path progress saving endpoint. The file lp_ajax_save_item.php accepts a uid (user ID) parameter directly from…
more
$_REQUEST and uses it to load and modify another user's Learning Path progress — including score, status, completion, and time — without verifying that the requesting user matches the target user ID. Any authenticated user enrolled in a course can overwrite another user's Learning Path progress by simply changing the uid parameter in the request. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
IDOR in web-based LMS endpoint enables unauthorized stored data modification (T1565.001) and is exploitable via network-accessible web app (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces approved authorizations to prevent authenticated users from modifying another user's Learning Path progress via the uid parameter.
Implements least privilege to restrict users to accessing and modifying only their own Learning Path progress data.
Validates the uid input parameter against the authenticated user's identity to block unauthorized object references.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Enforcing authorization policy and least privilege directly blocks user-controlled key tampering that bypasses access checks.
Logical access controls prevent unauthorized data access that results from missing authorization checks on object references.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect missing authorization checks but does not prevent the weakness in production.
Information access restriction explicitly enforces that users may only retrieve data they are authorized to see, directly addressing user-controlled key bypass.
Access control policy directly requires enforcement of authorization rules that prevent unauthorized access via manipulated keys.
Managing access rights includes ensuring users can only access their own records and not bypass authorization by altering identifiers.
Privileged access rights control restricts what data each user may access, mitigating direct object reference attacks.
Secure development lifecycle includes authorization design but does not itself implement runtime access checks.