Access Control

Every one of the 13 is a mark on the map. Named now: 1 to 13, most at risk first.

1. A remote code execution (RCE) vulnerability in course_intro_pdf_import.php of Chamilo LMS v1.11.x allows authenticated attackers to execute arbitrary code via a crafted .htaccess…CVE-2021-35413Chamilo · 2.6% likely

   CWE-862

2. Chamilo Chamilo-lms version 1.11.8 and earlier contains an Incorrect Access Control vulnerability in Tickets component that can result in an authenticated user can read all ticket…CVE-2019-1000017Chamilo · 1.0% likely

   CWE-862

3. Chamilo LMS 1.11.10 does not properly manage privileges which could allow a user with Sessions administrator privilege to create a new user then use the edit user function to chan…CVE-2020-23128Chamilo · 0.9% likely

   CWE-269

4. Chamilo LMS 1.11.26 is vulnerable to Incorrect Access Control via main/auth/profile. Non-admin users can manipulate sensitive profiles information, posing a significant risk to da…CVE-2024-30616Chamilo · CVSS 8.8 · 0.6% likely

   CWE-863

5. Chamilo Authenticated Remote Code ExecutionCVE-2026-34239chamilo · CVSS 7.5 · 0.5% likely

   CWE-285

6. Chamilo LMS Legal Consent SocialController.php deleteLegal improper authorizationCVE-2026-1106Chamilo · CVSS 5.4 · 0.4% likely

   CWE-266

7. Incorrect access control in Chamilo 1.11.* up to 1.11.18 allows a student subscribed to a given course to download documents belonging to another student if they know the document…CVE-2023-34958Chamilo · CVSS 4.3 · 0.4% likely

   CWE-863

8. Chamilo LMS has Privilege Escalation via API User Role ModificationCVE-2026-40291chamilo · CVSS 8.8 · 0.3% likely

   CWE-269

9. Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization in AJAX HandlersCVE-2026-114390chamilo · CVSS 5.3 · 0.2% likely

   CWE-862

10. Chamilo LMS has REST API PII Exposure via get_user_info_from_usernameCVE-2026-33708chamilo · CVSS 6.5 · 0.2% likely

    CWE-862

11. Chamilo: Unauthorized access to update category of any userCVE-2025-59544chamilo · CVSS 6.9 · 0.2% likely

    CWE-862

12. Chamilo LMS has a REST API Self-Privilege Escalation (Student → Teacher)CVE-2026-33706chamilo · CVSS 7.1 · 0.2% likely

    CWE-269

13. Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization via GradebookControllerCVE-2026-114388chamilo · CVSS 5.3 · 0.2% likely

    CWE-862

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.