Vulnerability · Published Jul 20, 2026 · Assigned by GitHub_M
CVE-2026-39878Chamilo stored XSS via user registration leads to admin account takeover
Critical 9.3
In plain English
A critical-severity cross-site scripting in chamilo-lms from chamilo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).
Severity (CVSS 3.1)9.3Critical
Exploit odds (30 days)0.4%top 62.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form that allows any unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser session, leading to full platform admin account takeover. This has been patched in 1.11.40.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| chamilo | chamilo-lms | <= 1.11.38 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
References
- https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-gcjp-f7jm-rrrg x_refsource_CONFIRM
- https://vokecyber.com/research/cve-2026-39878-chamilo-lms-stored-xss x_refsource_MISC