CVE-2026-114390: Missing Authorization in chamilo chamilo-lms

CVE-2026-114390 is a missing authorization vulnerability in Chamilo LMS affecting versions >=2.0.0-alpha.1 and <2.0.0-RC.3. The issue resides in legacy AJAX handlers under public/main/inc/ajax/, which do not properly enforce authorization checks. As a result, unauthenticated or low-privileged users can invoke actions like get_users_by_group_course, user_by_all_roles, and export_all_certificates to harvest sensitive information including user names and certificate PDFs belonging to other learners.

The vulnerability allows unauthorized disclosure of personally identifiable information (user names) and certificate documents of learners. This can lead to privacy violations and potential misuse of certificate data. There is no indication of privilege escalation or remote code execution. The CVSS 4.0 base score is 6.9, indicating a medium severity impact with network attack vector, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected AJAX endpoints or disable legacy AJAX handlers if possible to prevent unauthorized access. Monitor vendor channels for updates and apply patches promptly once released.