CVE-2026-114390

Chamilo LMS from 2.0.0-alpha.1 before 2.0.0-RC.3 contains a missing authorization vulnerability in legacy AJAX handlers under public/main/inc/ajax/ that exposes user names and certificates. Unauthenticated or low-privileged users can call actions like get users by group course, user by all roles, and export all certificates to harvest user names and other learners' certificate PDFs.