Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:NSummary
CVE-2026-33715 is a high-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Chamilo Chamilo Lms. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 11th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-14 (Permitted Actions Without Identification or Authentication) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-33715 affects Chamilo LMS, an open-source learning management system, specifically in version 2.0-RC.2. The vulnerability stems from the file public/main/inc/ajax/install.ajax.php being accessible without authentication on fully installed instances, as it lacks inclusion of the global.inc.php file that enforces authentication and installation checks. The test_mailer action within this endpoint accepts an arbitrary Symfony Mailer DSN string from POST data, enabling Server-Side Request Forgery (SSRF) over the SMTP protocol (CWE-918, CWE-306). The issue has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).
Unauthenticated remote attackers can exploit this vulnerability by sending POST requests to the endpoint with a malicious SMTP DSN. This allows them to force the Chamilo server to connect to an attacker-specified SMTP server, facilitating SSRF to probe internal networks. Attackers can also abuse the endpoint to turn the server into an open email relay for phishing or spam campaigns, with emails appearing to originate from the server's IP address. Additionally, error responses from failed SMTP connections may leak information about internal network topology and services.
The vulnerability has been addressed in Chamilo LMS version 2.0.0-RC.3, as detailed in the project's GitHub release notes and security advisory (GHSA-mxc9-9335-45mc). Security practitioners should upgrade to the patched version and verify that the install.ajax.php endpoint is no longer accessible without proper authentication checks.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22710
Vulnerability Data
Chamilo LMS is an open-source learning management system. In version 2.0-RC.2, the file public/main/inc/ajax/install.ajax.php is accessible without authentication on fully installed instances because, unlike other AJAX endpoints, it does not include the global.inc.php file that performs authentication and installation-completed checks.…
more
Its test_mailer action accepts an arbitrary Symfony Mailer DSN string from POST data and uses it to connect to an attacker-specified SMTP server, enabling Server-Side Request Forgery (SSRF) into internal networks via the SMTP protocol. An unauthenticated attacker can also abuse this to weaponize the Chamilo server as an open email relay for phishing and spam campaigns, with emails appearing to originate from the server's IP address. Additionally, error responses from failed SMTP connections may disclose information about internal network topology and running services. This issue has been fixed in version 2.0.0-RC.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 6 hardening rules · 3 OS baselines
V6.2.3V6.4.4V10.4.16V12.1.3
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates unique identification and authentication of users before access to functions requiring identity.
Extends the same authentication requirement to non-organizational users accessing critical functionality.
Requires authentication of services before they can invoke or expose critical functions.
Explicitly identifies and limits actions permitted without authentication, preventing critical functions from being exposed.
Information flow enforcement can restrict which destinations the server is allowed to contact on behalf of users.
Input validation directly stops untrusted URLs from being accepted and fetched without destination checks.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Directly requires authentication of users/services/hardware, which eliminates missing authentication for critical functions.
Secure development practices directly include input validation and destination allow-listing that prevent SSRF.
Runtime monitoring of web applications and services can detect anomalous outbound requests indicative of SSRF.
Vulnerability identification processes can discover and record SSRF flaws in web applications.
Managing identities and credentials is a prerequisite for authentication but does not itself enforce it on critical functions.
Defining and enforcing authorizations assumes prior authentication and therefore only partially mitigates the absence of authentication.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
The control explicitly calls for authentication before any critical function is reached, eliminating the possibility of bypassing authentication for high-value operations.
Operational threat data describing SSRF campaigns can be used to tighten outbound-request allow-lists and detection rules before attackers exploit them.
Mandating authentication requirements for critical functions at the requirements-gathering stage ensures that essential operations are not left unprotected by missing login or verification mechanisms.
Mandating authentication for network services and critical functions stops attackers from invoking sensitive operations without credentials, closing gaps where authentication is absent for important capabilities.
Security engineering principles insist on authentication and authorization for every critical function, eliminating entry points that lack any access control mechanism.
Requiring strong authentication and access-privilege enablement for remote connections ensures that critical functions cannot be invoked without proper verification, closing a gap that would otherwise allow unauthenticated use.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (2 rules)
- V-248585 OL 8 must require reauthentication when using the "sudo" command. prevents CWE-306
- V-248827 OL 8 must not have the rsh-server package installed. prevents CWE-306
RHEL 7 (2 rules)
- V-204442 The Red Hat Enterprise Linux operating system must not have the rsh-server package installed. prevents CWE-306
- V-237635 The Red Hat Enterprise Linux operating system must require re-authentication when using the "sudo" command. prevents CWE-306
RHEL 8 (2 rules)
- V-230492 RHEL 8 must not have the rsh-server package installed. prevents CWE-306
- V-237643 RHEL 8 must require re-authentication when using the "sudo" command. prevents CWE-306