Chamilo LMS User Data Exposure Vulnerability

A vulnerability in Chamilo LMS prior to version 2.0.0-RC.3 allows any authenticated user, including those with the ROLE_STUDENT, to enumerate all users on the platform and access personal information such as email addresses, phone numbers, and roles. This includes visibility into administrator accounts. The issue arises because the User API's GetCollection operation is accessible to all users with ROLE_USER, a category that includes all authenticated users. As a result, students can list all users and their details through the API.

Impact

This vulnerability exposes the personal information of all users, including emails, phone numbers, and roles, to any authenticated user. It also allows for the identification of admin accounts, which could be targeted for phishing attacks.

Remediation

Users can upgrade to Chamilo LMS version 2.0.0-RC.3 or later to address this vulnerability.