Chamilo LMS IDOR Flaw Exposes User-Course Enrollments

The National Vulnerability Database has flagged CVE-2026-34602, a high-severity Insecure Direct Object Reference (IDOR) vulnerability impacting Chamilo LMS, an open-source learning management system. Specifically, versions prior to 2.0.0-RC.3 are susceptible via the /api/course_rel_users endpoint. This flaw allows an authenticated attacker to manipulate the user parameter in a request, enabling them to enroll any user into any course without proper authorization.

This isn’t just a minor oversight; it’s a classic IDOR where the backend blindly trusts user-supplied input without verifying if the requester actually owns or has permission to act on behalf of the referenced user ID. The implications are pretty stark: unauthorized access to course materials, bypassing enrollment controls, and a significant hit to platform integrity. Imagine someone getting access to sensitive training modules they shouldn’t even know exist. The good news is, Chamilo has addressed this in version 2.0.0-RC.3, so patching is critical.