Insecure Direct Object Reference

Every one of the 8 is a mark on the map. Named now: 1 to 8, most at risk first.

1. Chamilo LMS 2.0.0-alpha.4 before 2.0.0-RC.3 Missing Authorization via openAnswerGradeCVE-2026-114389chamilo · CVSS 4.3 · 0.3% likely

   CWE-639

2. Chamilo LMS has an Insecure Direct Object Reference (IDOR)CVE-2026-33702chamilo · CVSS 7.1 · 0.2% likely

   CWE-639

3. Chamilo LMS: IDOR in the Notebook Module allows an attacker to view other users' private notesCVE-2026-34370chamilo · CVSS 6.5 · 0.2% likely

   CWE-639

4. Chamilo LMS has an Insecure Direct Object Reference (IDOR) - User Data ExposureCVE-2026-33736chamilo · CVSS 6.5 · 0.2% likely

   CWE-639

5. Chamilo LMS: IDOR in /api/course_rel_users Allows Unauthorized Enrollment of Arbitrary Users into CoursesCVE-2026-34602chamilo · CVSS 7.1 · 0.2% likely

   CWE-639

6. Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Evaluation Edit Without Ownership CheckCVE-2026-32930chamilo · CVSS 7.1 · 0.2% likely

   CWE-639

7. Chamilo LMS Critical IDOR: Any Authenticated User Can Extract All Users’ Personal Data and API TokensCVE-2026-33703chamilo · CVSS 7.1 · 0.2% likely

   CWE-639

8. Chamilo LMS has an IDOR in REST API Stats Endpoint Exposes Any User's Learning DataCVE-2026-33141chamilo · CVSS 6.5 · 0.1% likely

   CWE-639

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.