CVE-2026-33703 is an authorization bypass vulnerability in Chamilo LMS prior to version 2.0.0-RC.3. The issue is an Insecure Direct Object Reference (CWE-639) in the /social-network/personal-data/{userId} API endpoint, which fails to properly restrict access based on the authenticated user's identity. By manipulating the userId parameter, an authenticated attacker can retrieve full personal data and API tokens of arbitrary users. This vulnerability enables unauthorized disclosure of sensitive information and credentials, compromising the confidentiality of the platform's user data. The vulnerability is fixed in Chamilo LMS 2.0.0-RC.3.

Exploitation of this vulnerability allows any authenticated user to access sensitive personal data and API tokens belonging to other users. This can lead to a full platform data breach, exposing confidential user information and credentials. The CVSS 4.0 score of 7.1 reflects a high severity impact due to network attack vector, low attack complexity, no privileges required beyond authentication, and high impact on confidentiality.

Upgrade Chamilo LMS to version 2.0.0-RC.3 or later, where this vulnerability is fixed. Since the vendor advisory confirms the fix in 2.0.0-RC.3, applying this official update is the recommended remediation. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated.