Chamilo LMS REST API Personal Information Exposure Vulnerability

A vulnerability in Chamilo LMS prior to version 1.11.38 allows any authenticated user, including students, to access personal information of other users through the get_user_info_from_username REST API endpoint. The exposed data includes email addresses, first names, last names, user IDs, and active status. This issue arises from a lack of authorization checks, enabling unauthorized data access via the API.

Impact

This vulnerability allows authenticated users to collect personal information from all users, including email addresses and real names. Such data exposure could lead to targeted phishing and social engineering attacks. Additionally, when combined with other vulnerabilities in Chamilo LMS, it could facilitate account takeover, particularly for admin users.

Remediation

Users can update to Chamilo LMS version 1.11.38 or later, where this vulnerability has been fixed.