CVE-2026-45144

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions prior to 2.0.1

Description The application allows anonymous access to the GET /user/{username} endpoint. This endpoint renders six user-editable profile fields—firstname, lastname, competences, openarea, teach, and diplomas—without server-side sanitization and with auto-escaping disabled. An attacker with the ROLE STUDENT role, which can be obtained via self-registration if enabled, can inject malicious HTML into their own profile. This stored content executes in the browser of any visitor, including administrators, who views the public profile link, potentially leading to account takeover through the exfiltration of session data, JWT (JSON Web Tokens), or localStorage data.

Recommendations Update to version 2.0.1.