CVE-2026-34602 Chamilo LMS: IDOR in /api/course_rel_users Allows Unauthorized Enrollment of Arbitrary Users into Courses

High 7.1 Published 14 Apr 2026 Updated 15 Apr 2026

Authenticated attackers can enroll arbitrary users into courses via IDOR in the API, bypassing enrollment controls and compromising platform integrity.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-34602?

CVE-2026-34602 is a high-severity missing authorization vulnerability in Chamilo Chamilo Lms, published on 14 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the /api/course_rel_users endpoint is vulnerable to Insecure Direct Object Reference (IDOR), allowing an authenticated attacker to modify the user parameter in the request body to enroll any arbitrary user into any course without proper authorization checks. The backend trusts the user-supplied input for the user field and performs no server-side verification that the requester owns the referenced user ID or has permission to act on behalf of other users. This enables unauthorized manipulation of user-course relationships, potentially granting unintended access to course materials, bypassing enrollment controls, and compromising platform integrity. This issue has been fixed in version 2.0.0-RC.3.

Weakness: CWE-639

Which versions are affected by CVE-2026-34602?

It affects 1 product.

Products include Chamilo Chamilo Lms.

How do I fix CVE-2026-34602?

No fix has been published for CVE-2026-34602 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-34602 being exploited?

There is no known exploitation of CVE-2026-34602 in the wild and no public exploit code.

All Chamilo Chamilo Lms vulnerabilities

Sources

Also known as GHSA-x373-8j9j-g5pj.