CVE-2026-30876 Chamilo LMS: User enumeration vulnerability via response

What is CVE-2026-30876?

CVE-2026-30876 is a medium-severity vulnerability in Chamilo Chamilo Lms, published on 16 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Chamilo LMS is a learning management system. Prior to version 1.11.36, Chamilo is vulnerable to user enumeration with valid/invalid username. This issue has been patched in version 1.11.36.

Weakness: CWE-204

Which versions are affected by CVE-2026-30876?

It affects 1 product.

Products include Chamilo Chamilo Lms.

How do I fix CVE-2026-30876?

No fix has been published for CVE-2026-30876 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-30876 being exploited?

There is no known exploitation of CVE-2026-30876 in the wild and no public exploit code.

Other vulnerabilities in Chamilo Chamilo Lms

• CVE-2025-50187 Chamilo: Evaluation of untrusted user input leads to Remote Code Execution Critical 9.8
• CVE-2023-34944 File upload in n/a Critical 9.8
• CVE-2022-27423 SQL injection in n/a Critical 9.8
• CVE-2021-35414 SQL injection in n/a Critical 9.8
• CVE-2019-13082 File upload in n/a Critical 9.8

All Chamilo Chamilo Lms vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cqr8-vvqp-4mp4.