CVE-2026-114390

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions 2.0.0-alpha.1 through 2.0.0-RC.2

Description Missing authorization in legacy AJAX handlers located under public/main/inc/ajax/ allows unauthenticated or low-privileged users to harvest user names and certificate PDFs of other learners. This is achieved by calling the functions get users by group course(), user by all roles(), and export all certificates().

Recommendations Update Chamilo LMS to version 2.0.0-RC.3 or later. As a temporary mitigation, restrict access to the legacy AJAX handlers under public/main/inc/ajax/.