CVE-2026-34370 (GCVE-0-2026-34370)
Vulnerability from cvelistv5 – Published: 2026-04-14 21:25 – Updated: 2026-04-15 20:03
VLAI
EPSS
VEX
Title
Chamilo LMS: IDOR in the Notebook Module allows an attacker to view other users' private notes
Summary
Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the notebook module contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated student to read the private course notes of any other user on the platform by manipulating the notebook_id parameter in the editnote action. The application fetches the note content using only the supplied integer ID without verifying that the requesting user owns the note, and the full title and HTML body are rendered in the edit form and returned to the attacker's browser. While ownership checks exist in the write paths (updateNote() and delete_note()), they are entirely absent from the read path (get_note_information()). This issue has been fixed in version 2.0.0-RC.3.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/chamilo/chamilo-lms/security/a… | x_refsource_CONFIRM |
| https://github.com/chamilo/chamilo-lms/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| chamilo | chamilo-lms |
Affected:
< 2.0.0-RC.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-34370",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-15T18:57:17.887701Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-15T20:03:07.959Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "chamilo-lms",
"vendor": "chamilo",
"versions": [
{
"status": "affected",
"version": "\u003c 2.0.0-RC.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the notebook module contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated student to read the private course notes of any other user on the platform by manipulating the notebook_id parameter in the editnote action. The application fetches the note content using only the supplied integer ID without verifying that the requesting user owns the note, and the full title and HTML body are rendered in the edit form and returned to the attacker\u0027s browser. While ownership checks exist in the write paths (updateNote() and delete_note()), they are entirely absent from the read path (get_note_information()). This issue has been fixed in version 2.0.0-RC.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285: Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-14T21:25:28.960Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-fm35-2hvw-564q",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-fm35-2hvw-564q"
},
{
"name": "https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3"
}
],
"source": {
"advisory": "GHSA-fm35-2hvw-564q",
"discovery": "UNKNOWN"
},
"title": "Chamilo LMS: IDOR in the Notebook Module allows an attacker to view other users\u0027 private notes"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-34370",
"datePublished": "2026-04-14T21:25:28.960Z",
"dateReserved": "2026-03-27T13:43:14.369Z",
"dateUpdated": "2026-04-15T20:03:07.959Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-34370",
"date": "2026-08-04",
"epss": "0.00227",
"percentile": "0.13485"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-34370\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-04-14T22:16:31.340\",\"lastModified\":\"2026-07-24T22:10:00.140\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the notebook module contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated student to read the private course notes of any other user on the platform by manipulating the notebook_id parameter in the editnote action. The application fetches the note content using only the supplied integer ID without verifying that the requesting user owns the note, and the full title and HTML body are rendered in the edit form and returned to the attacker\u0027s browser. While ownership checks exist in the write paths (updateNote() and delete_note()), they are entirely absent from the read path (get_note_information()). This issue has been fixed in version 2.0.0-RC.3.\"},{\"lang\":\"es\",\"value\":\"Chamilo LMS es un sistema de gesti\u00f3n de aprendizaje de c\u00f3digo abierto. En versiones anteriores a 2.0.0-RC.3, el m\u00f3dulo de cuaderno contiene una vulnerabilidad de Referencia Directa Insegura a Objeto (IDOR) que permite a cualquier estudiante autenticado leer las notas privadas del curso de cualquier otro usuario en la plataforma manipulando el par\u00e1metro notebook_id en la acci\u00f3n editnote. La aplicaci\u00f3n obtiene el contenido de la nota utilizando solo el ID entero proporcionado sin verificar que el usuario solicitante sea el propietario de la nota, y el t\u00edtulo completo y el cuerpo HTML se renderizan en el formulario de edici\u00f3n y se devuelven al navegador del atacante. Si bien existen comprobaciones de propiedad en las rutas de escritura (updateNote() y delete_note()), est\u00e1n completamente ausentes de la ruta de lectura (get_note_information()). Este problema ha sido solucionado en la versi\u00f3n 2.0.0-RC.3.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"chamilo\",\"product\":\"chamilo-lms\",\"versions\":[{\"version\":\"\u003c 2.0.0-RC.3\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-04-15T18:57:17.887701Z\",\"id\":\"CVE-2026-34370\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-285\"},{\"lang\":\"en\",\"value\":\"CWE-639\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.11.38\",\"matchCriteriaId\":\"34085140-9203-4B20-9036-743718F1A4F8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha1:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AF7661F-C1F7-4CAB-BBDF-FC5BF7F5BEB8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha2:*:*:*:*:*:*\",\"matchCriteriaId\":\"FE56AF71-9D53-42C6-980D-09E1C418ED87\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha3:*:*:*:*:*:*\",\"matchCriteriaId\":\"01195674-9E1A-4C07-B7D3-0F0CC2E6511B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha4:*:*:*:*:*:*\",\"matchCriteriaId\":\"BAE63449-5A56-4302-A4BF-F3D19FC96A80\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha5:*:*:*:*:*:*\",\"matchCriteriaId\":\"A84A06F9-5AB7-4703-8153-33AC68882B95\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B91302A3-53DE-4ED0-BAAB-FE9DA03F8242\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta2:*:*:*:*:*:*\",\"matchCriteriaId\":\"46008D4A-96F7-4E04-8256-E115AAAE3383\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta3:*:*:*:*:*:*\",\"matchCriteriaId\":\"6E2BCAFF-D44B-4E67-998A-DF855E27606B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"D2E7D018-E4C2-45F5-8D9A-DAC947173607\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DAF96697-6B6D-459D-9510-E5CEEDC2859B\"}]}]}],\"references\":[{\"url\":\"https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Product\",\"Release Notes\"]},{\"url\":\"https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-fm35-2hvw-564q\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
"redhat_vex": {
"current_release_date": "2026-04-16T01:22:34+00:00",
"cve": "CVE-2026-34370",
"id": "CVE-2026-34370",
"initial_release_date": "2026-01-01T00:00:00+00:00",
"product_status:known_not_affected": "1",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "Chamilo LMS: IDOR in the Notebook Module allows an attacker to view other users\u0027 private notes",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34370.json",
"version": "3"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-34370\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-15T18:57:17.887701Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-15T18:57:26.117Z\"}}], \"cna\": {\"title\": \"Chamilo LMS: IDOR in the Notebook Module allows an attacker to view other users\u0027 private notes\", \"source\": {\"advisory\": \"GHSA-fm35-2hvw-564q\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"chamilo\", \"product\": \"chamilo-lms\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 2.0.0-RC.3\"}]}], \"references\": [{\"url\": \"https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-fm35-2hvw-564q\", \"name\": \"https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-fm35-2hvw-564q\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3\", \"name\": \"https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the notebook module contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated student to read the private course notes of any other user on the platform by manipulating the notebook_id parameter in the editnote action. The application fetches the note content using only the supplied integer ID without verifying that the requesting user owns the note, and the full title and HTML body are rendered in the edit form and returned to the attacker\u0027s browser. While ownership checks exist in the write paths (updateNote() and delete_note()), they are entirely absent from the read path (get_note_information()). This issue has been fixed in version 2.0.0-RC.3.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-285\", \"description\": \"CWE-285: Improper Authorization\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-639\", \"description\": \"CWE-639: Authorization Bypass Through User-Controlled Key\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-04-14T21:25:28.960Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-34370\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-15T20:03:07.959Z\", \"dateReserved\": \"2026-03-27T13:43:14.369Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-04-14T21:25:28.960Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…