Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
Chamilo Improper Privilege Management Vulnerability - CVE-2026-33706 - Vulnerability Database
Chamilo

Chamilo Improper Privilege Management Vulnerability - CVE-2026-33706

High
Reference: CVE-2026-33706
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2026-33706
Title: Chamilo Improper Privilege Management Vulnerability
Overview:

Chamilo LMS is a learning management system. Prior to 1.11.38 any authenticated user with a REST API key can modify their own status field via the update_user_from_username endpoint. A student (status5) can change their status to Teacher/CourseManager (status1) gaining course creation and management privileges. This vulnerability is fixed in 1.11.38.