CVE-2024-30616 Missing authorization in n/a

What is CVE-2024-30616?

CVE-2024-30616 is a high-severity missing authorization vulnerability in Chamilo Chamilo Lms, published on 4 Nov 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Chamilo LMS 1.11.26 is vulnerable to Incorrect Access Control via main/auth/profile. Non-admin users can manipulate sensitive profiles information, posing a significant risk to data integrity.

Weakness: CWE-863

Which versions are affected by CVE-2024-30616?

It affects 1 product.

Products include Chamilo Chamilo Lms.

How do I fix CVE-2024-30616?

No fix has been published for CVE-2024-30616 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-30616 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-30616 exists.

Other vulnerabilities in Chamilo Chamilo Lms

• CVE-2025-50187 Chamilo: Evaluation of untrusted user input leads to Remote Code Execution Critical 9.8
• CVE-2023-34944 File upload in n/a Critical 9.8
• CVE-2022-27423 SQL injection in n/a Critical 9.8
• CVE-2021-35414 SQL injection in n/a Critical 9.8
• CVE-2019-13082 File upload in n/a Critical 9.8

All Chamilo Chamilo Lms vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7hpj-6m83-46cj.