Chamilo LMS, an open-source learning management system widely used in educational institutions, contained a missing authorization vulnerability identified as CVE-2025-59544 (CWE-862). Prior to version 1.11.34, the system's functionality allowing users to update the 'category_id' parameter did not implement proper authorization checks. This flaw permits any user, without authentication or privileges, to alter the category assignment of any other user by simply replacing the 'category_id' parameter in the update request. The vulnerability is remotely exploitable over the network without user interaction, making it relatively easy for attackers to manipulate user categorizations. Such unauthorized changes could lead to privilege escalation scenarios, misclassification of users, or disruption of organizational user management policies. The issue was officially published in March 2026 and has been patched in version 1.11.34. The CVSS 4.0 vector indicates no required privileges, no user interaction, and no impact on confidentiality or availability, but a low impact on integrity, resulting in a base score of 6.9 (medium severity). No known exploits have been reported in the wild to date, but the vulnerability poses a significant risk to organizations relying on Chamilo LMS for managing user roles and categories.

The primary impact of CVE-2025-59544 is on the integrity of user data within Chamilo LMS installations. Unauthorized users can modify the category assignments of other users, potentially leading to unauthorized access to resources, misrepresentation of user roles, or disruption of learning workflows. This could facilitate privilege escalation if categories are linked to access controls or permissions. Although confidentiality and availability are not directly affected, the integrity compromise can undermine trust in the LMS and cause administrative overhead to detect and remediate unauthorized changes. Organizations worldwide using vulnerable versions risk unauthorized internal manipulation, which could affect compliance with data governance policies and educational standards. The ease of exploitation without authentication increases the threat level, especially in publicly accessible LMS deployments.

Organizations should immediately upgrade Chamilo LMS to version 1.11.34 or later, where the authorization checks for the 'category_id' parameter have been properly implemented. Until the upgrade is possible, administrators should restrict network access to the LMS to trusted users only, implement web application firewalls (WAFs) with rules to detect and block unauthorized category update attempts, and monitor logs for suspicious category modification activities. Additionally, reviewing user roles and permissions to minimize the impact of unauthorized changes can help. Regular audits of user categories and access controls should be conducted to detect anomalies. Employing multi-factor authentication and network segmentation can further reduce the risk of exploitation. Finally, organizations should stay informed about any emerging exploits targeting this vulnerability.