CVE-2026-40291

🗓️ 14 Apr 2026 21:37:55Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 5 Views🌐 WEB

Privilege escalation in Chamilo LMS before two thousand twenty six? Not good.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2026-40291	14 Apr 202621:37	–	attackerkb
Circl	CVE-2026-40291	14 Apr 202623:22	–	circl
CNNVD	Chamilo LMS 安全漏洞	14 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-40291 Chamilo LMS has Privilege Escalation via API User Role Modification	14 Apr 202621:37	–	cvelist
EUVD	EUVD-2026-22772	14 Apr 202621:37	–	euvd
NVD	CVE-2026-40291	14 Apr 202622:16	–	nvd
Positive Technologies	PT-2026-32939	14 Apr 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-40291	5 Jun 202619:13	–	redhatcve
Vulnrichment	CVE-2026-40291 Chamilo LMS has Privilege Escalation via API User Role Modification	14 Apr 202621:37	–	vulnrichment

NVD

Vulners

Node

chamilo chamilo_lmsRange≤1.11.38

chamilo chamilo_lmsMatch2.0.0alpha1

chamilo chamilo_lmsMatch2.0.0alpha2

chamilo chamilo_lmsMatch2.0.0alpha3

chamilo chamilo_lmsMatch2.0.0alpha4

chamilo chamilo_lmsMatch2.0.0alpha5

chamilo chamilo_lmsMatch2.0.0beta1

chamilo chamilo_lmsMatch2.0.0beta2

chamilo chamilo_lmsMatch2.0.0beta3

chamilo chamilo_lmsMatch2.0.0rc1

chamilo chamilo_lmsMatch2.0.0rc2

[
  {
    "vendor": "chamilo",
    "product": "chamilo-lms",
    "versions": [
      {
        "version": "< 2.0-RC.3",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/chamilo/chamilo-lms/security/advisories/GHSA-7phx-w897-4c9x
github	www.github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3

Parameter	Position	Path	Description	CWE
roles	request body	/api/users/{id}	Insecure direct object modification via PUT /api/users/{id} allows authenticated users with ROLE_STUDENT to escalate to ROLE_ADMIN by modifying the writable roles field.	CWE-863, CWE-269

17 Jun 2026 10:44Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.18.8

EPSS0.00316

SSVC