CVE-2026-45141

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, the add, delete gradebook from skill, save profile, and delete profile actions in public/main/inc/ajax/skill.ajax.php perform database mutations without Security::check token() validation. An attacker can use cross-site request forgery to cause an authenticated administrator or DRH who visits a malicious page to create, modify, or delete skill records and profiles, or remove skill-gradebook associations. This issue is fixed in version 2.0.1.