by Kastro
Paper/Archive/CVE-2026-33707

CVE-2026-33707

chamilo chamilo-lms — Weak Password Recovery Mechanism for Forgotten Password in chamilo/chamilo-lms

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 36.9.369 × 207.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, the default password reset mechanism generates tokens using sha1($email) with no random component, no expiration, and no rate limiting. An attacker who knows a user's email can compute the reset token and change the victim's password without authentication. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

Affected

ProductAffectedFixed inSource
chamilo-lms< 1.11.38–CNA
chamilo-lms>= 2.0.0-alpha.1, < 2.0.0-RC.3–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/chamilo/chamilo-lms/security/advisories/GHSA-f27g-66gq-g7v2refgithub.com/chamilo/chamilo-lms/commit/078d7e5b77679fa7ccfcd6783bd5cc683db0bda8refgithub.com/chamilo/chamilo-lms/commit/750a45312a0d5c3ad60dbfbd0d959ca40be4a18c