CVE-2026-1106

🗓️ 18 Jan 2026 00:02:09Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 18 Views🌐 WEB

Chamilo vulnerability enables remote userId manipulation in deleteLegal causing authorization issues.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2026-1106	18 Jan 202600:02	–	attackerkb
Circl	CVE-2026-1106	18 Jan 202601:33	–	circl
CNNVD	Chamilo LMS authorization issue vulnerability	18 Jan 202600:00	–	cnnvd
Cvelist	CVE-2026-1106 Chamilo LMS Legal Consent SocialController.php deleteLegal improper authorization	18 Jan 202600:02	–	cvelist
EUVD	EUVD-2026-3191	18 Jan 202600:02	–	euvd
NVD	CVE-2026-1106	18 Jan 202601:15	–	nvd
Positive Technologies	PT-2026-3374	18 Jan 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-1106	19 Jan 202600:22	–	redhatcve
Vulnrichment	CVE-2026-1106 Chamilo LMS Legal Consent SocialController.php deleteLegal improper authorization	18 Jan 202600:02	–	vulnrichment

NVD

Node

chamilo chamilo_lmsRange<2.0.0

chamilo chamilo_lmsMatch2.0.0alpha1

chamilo chamilo_lmsMatch2.0.0alpha2

chamilo chamilo_lmsMatch2.0.0alpha3

chamilo chamilo_lmsMatch2.0.0alpha4

chamilo chamilo_lmsMatch2.0.0alpha5

chamilo chamilo_lmsMatch2.0.0beta1

[
  {
    "vendor": "Chamilo",
    "product": "LMS",
    "versions": [
      {
        "version": "2.0.0 Beta 1",
        "status": "affected"
      }
    ],
    "modules": [
      "Legal Consent Handler"
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
note-hxlab	www.note-hxlab.wetolink.com/share/w92t1Q0a74Gj
vuldb	www.vuldb.com/

Parameter	Position	Path	Description	CWE
userId	path	src/CoreBundle/Controller/SocialController.php	Improper authorization via manipulation of userId in deleteLegal function of SocialController.php (Legal Consent Handler).	CWE-285, CWE-266

17 Jun 2026 10:15Current

6.3Medium risk

Vulners AI Score6.3

CVSS 45.3

CVSS 3.15.4

CVSS 25.5

CVSS 35.4

EPSS0.00393

SSVC