Vulnerability · Published Apr 10, 2026 · Assigned by GitHub_M
CVE-2026-33708Chamilo LMS has REST API PII Exposure via get_user_info_from_username
Medium 6.5
In plain English
A medium-severity missing authorization in chamilo-lms from chamilo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.2%top 88.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Chamilo LMS is a learning management system. Prior to 1.11.38, the get_user_info_from_username REST API endpoint returns personal information (email, first name, last name, user ID, active status) of any user to any authenticated user, including students. There is no authorization check. This vulnerability is fixed in 1.11.38.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| chamilo | chamilo-lms | < 1.11.38 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N